@kontextmind/kxm 0.7.20 → 0.7.22

package/plugins/kxm/dist/cli.js

@@ -14780,7 +14780,7 @@ var require_dist = __commonJS({
 
 // plugins/kxm/src/cli.ts
 import { resolve as resolve30 } from "node:path";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -18329,6 +18329,25 @@ function planKxmPackageUpdate(source, latest, releaseDir, asset) {
   return steps;
 }
 
+// plugins/kxm/src/repo-root.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+var ROOT_MARKERS = ["scripts/kxm-hub.mjs", "scripts/kxm.mjs"];
+var MAX_WALK_DEPTH = 10;
+function findKxmRepoRoot(fromUrl = import.meta.url) {
+  let dir = dirname(fileURLToPath(fromUrl));
+  for (let depth = 0; depth < MAX_WALK_DEPTH; depth += 1) {
+    if (ROOT_MARKERS.some((marker) => existsSync2(join2(dir, marker)))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(
+    `kxm: cannot locate the KXM repo root from ${fileURLToPath(fromUrl)} (walked ${MAX_WALK_DEPTH} levels looking for ${ROOT_MARKERS[0]})`
+  );
+}
+
 // plugins/kxm/src/client.ts
 import { createHash as createHash3 } from "node:crypto";
 
@@ -19459,7 +19478,7 @@ var HubClient = class {
     while (!this.stopped && this.agent) {
       this.eventsAbort = new AbortController();
       try {
-        const response = await fetch(
+        const response = await (this.options.fetchImpl ?? fetch)(
           `${this.options.serverUrl.replace(/\/$/, "")}/v1/events?agentId=${encodeURIComponent(this.agent.id)}`,
           {
             headers: this.headers(),
@@ -19536,7 +19555,7 @@ var HubClient = class {
     const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
     let response;
     try {
-      response = await fetch(`${this.options.serverUrl.replace(/\/$/, "")}${path4}`, {
+      response = await (this.options.fetchImpl ?? fetch)(`${this.options.serverUrl.replace(/\/$/, "")}${path4}`, {
         ...init,
         signal,
         headers: { ...this.headers(includeIdentity), ...init.headers ?? {} }
@@ -19571,14 +19590,82 @@ var HubClient = class {
   }
 };
 
+// plugins/kxm/src/hub-env.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { dirname as dirname2, isAbsolute, join as join3, resolve } from "node:path";
+var HUB_ENV_SCHEMA = "kxm.hub-env.v1";
+var HubEnvError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HubEnvError";
+  }
+};
+function resolveUserStateRoot(env) {
+  const explicit = env.KXM_STATE_HOME?.trim();
+  if (explicit) {
+    if (!isAbsolute(explicit)) throw new HubEnvError("local_state_root_not_absolute");
+    return resolve(explicit);
+  }
+  if (process.platform === "win32") {
+    const localAppData = env.LOCALAPPDATA?.trim();
+    const base2 = localAppData && isAbsolute(localAppData) ? localAppData : join3(homedir(), "AppData", "Local");
+    return resolve(base2, "KXM");
+  }
+  if (process.platform === "darwin") return resolve(homedir(), "Library", "Application Support", "KXM");
+  const xdgState = env.XDG_STATE_HOME?.trim();
+  const base = xdgState && isAbsolute(xdgState) ? xdgState : join3(homedir(), ".local", "state");
+  return resolve(base, "kxm");
+}
+function hubEnvFile(env = process.env) {
+  return join3(resolveUserStateRoot(env), "hub-env.json");
+}
+function readHubEnvRecord(env = process.env) {
+  const file = hubEnvFile(env);
+  if (!existsSync3(file)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(file, "utf8"));
+  } catch (error) {
+    throw new HubEnvError(`hub env file is malformed at ${file}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new HubEnvError(`hub env file is malformed at ${file}: expected a JSON object`);
+  }
+  const record = parsed;
+  if (record.schema !== HUB_ENV_SCHEMA) {
+    throw new HubEnvError(`hub env file at ${file} has unsupported schema ${String(record.schema)}`);
+  }
+  if (record.authToken !== void 0 && (typeof record.authToken !== "string" || record.authToken.trim().length === 0)) {
+    throw new HubEnvError(`hub env file at ${file} has an invalid authToken`);
+  }
+  if (record.projectTokens !== void 0) {
+    const tokens = record.projectTokens;
+    if (!tokens || typeof tokens !== "object" || Array.isArray(tokens)) {
+      throw new HubEnvError(`hub env file at ${file} has invalid projectTokens`);
+    }
+    for (const [project, token] of Object.entries(tokens)) {
+      if (!project.trim() || typeof token !== "string" || !token.trim()) {
+        throw new HubEnvError(`hub env file at ${file} has an empty project name or token`);
+      }
+    }
+  }
+  return {
+    schema: HUB_ENV_SCHEMA,
+    createdAt: typeof record.createdAt === "string" ? record.createdAt : "",
+    ...record.authToken !== void 0 ? { authToken: record.authToken } : {},
+    ...record.projectTokens !== void 0 ? { projectTokens: record.projectTokens } : {}
+  };
+}
+
 // plugins/kxm/src/project-name.ts
-import { readFileSync as readFileSync2 } from "node:fs";
-import { basename, join as join2 } from "node:path";
+import { readFileSync as readFileSync3 } from "node:fs";
+import { basename, join as join4 } from "node:path";
 function defaultProjectName(cwd, env = process.env) {
   const fromEnv = env.KXM_PROJECT?.trim();
   if (fromEnv) return fromEnv;
   try {
-    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(join4(cwd, "package.json"), "utf8"));
     if (typeof pkg.name === "string" && pkg.name.trim().length > 0) return pkg.name.trim();
   } catch {
   }
@@ -19587,9 +19674,9 @@ function defaultProjectName(cwd, env = process.env) {
 
 // plugins/kxm/src/commands.ts
 import { createHash as createHash4, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
-import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join as join3, resolve } from "node:path";
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname3, join as join5, resolve as resolve2 } from "node:path";
 function requiredString(value, name) {
   if (typeof value !== "string" || value.trim() === "") throw new Error(`${name} is required`);
   return value.trim();
@@ -20337,18 +20424,18 @@ function parseSessionToken(token) {
   return void 0;
 }
 function resolveUserConfigDirectory(overrideDir) {
-  if (overrideDir) return resolve(overrideDir);
-  return resolve(process.env.KXM_USER_CONFIG_DIR?.trim() || join3(homedir(), ".config", "kxm"));
+  if (overrideDir) return resolve2(overrideDir);
+  return resolve2(process.env.KXM_USER_CONFIG_DIR?.trim() || join5(homedir2(), ".config", "kxm"));
 }
 function sessionTokenPath(userConfigDir) {
-  return join3(resolveUserConfigDirectory(userConfigDir), "session.token");
+  return join5(resolveUserConfigDirectory(userConfigDir), "session.token");
 }
 function persistSessionTokenToDisk(token, options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
-  const dir = dirname(filePath);
-  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const dir = dirname3(filePath);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
   const mode = options?.mode ?? 384;
-  writeFileSync2(filePath, `${token.trim()}
+  writeFileSync3(filePath, `${token.trim()}
 `, { encoding: "utf8", mode });
   try {
     chmodSync(filePath, mode);
@@ -20358,9 +20445,9 @@ function persistSessionTokenToDisk(token, options) {
 }
 function readSessionTokenFromDisk(options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
-  if (!existsSync2(filePath)) return void 0;
+  if (!existsSync4(filePath)) return void 0;
   try {
-    const token = readFileSync3(filePath, "utf8").trim();
+    const token = readFileSync4(filePath, "utf8").trim();
     if (!token) return void 0;
     const payload = parseSessionToken(token);
     if (!payload) return void 0;
@@ -20371,7 +20458,7 @@ function readSessionTokenFromDisk(options) {
 }
 function clearSessionTokenFromDisk(options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
-  if (!existsSync2(filePath)) return false;
+  if (!existsSync4(filePath)) return false;
   try {
     unlinkSync(filePath);
     return true;
@@ -20470,10 +20557,10 @@ function enforceToolPolicy(commandName, env = process.env, options) {
     return { allowed: true };
   }
   const tokenFile = sessionTokenPath(env.KXM_USER_CONFIG_DIR);
-  if (existsSync2(tokenFile)) {
+  if (existsSync4(tokenFile)) {
     let tokenRaw;
     try {
-      tokenRaw = readFileSync3(tokenFile, "utf8").trim();
+      tokenRaw = readFileSync4(tokenFile, "utf8").trim();
     } catch {
       return { allowed: false, error: "session_token_invalid", detail: "Session token file on disk could not be read" };
     }
@@ -20497,9 +20584,8 @@ function enforceToolPolicy(commandName, env = process.env, options) {
 var import__ = __toESM(require__(), 1);
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync4, lstatSync, readFileSync as readFileSync4, readdirSync, realpathSync } from "node:fs";
-import { basename as basename2, dirname as dirname2, extname, isAbsolute, join as join4, relative, resolve as resolve2, sep } from "node:path";
-import { fileURLToPath } from "node:url";
+import { existsSync as existsSync6, lstatSync, readFileSync as readFileSync5, readdirSync, realpathSync } from "node:fs";
+import { basename as basename2, dirname as dirname4, extname, isAbsolute as isAbsolute2, join as join6, relative, resolve as resolve3, sep } from "node:path";
 
 // plugins/kxm/src/restricted-yaml.mjs
 var import_yaml = __toESM(require_dist(), 1);
@@ -20827,7 +20913,7 @@ function resolveVnextTemplateBaseline(value) {
 
 // plugins/kxm/src/vnext-harness.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { win32 as win32Path } from "node:path";
 
 // plugins/kxm/src/vnext-oneshot-process.ts
@@ -21376,7 +21462,7 @@ function findWinNpmInnerExe(cliId, options = {}) {
   if ((options.platform ?? process.platform) !== "win32") return void 0;
   const segments = WIN_NPM_INNER_EXE[cliId];
   if (!segments) return void 0;
-  const exists = options.existsSync ?? existsSync3;
+  const exists = options.existsSync ?? existsSync5;
   const pathEnv = options.pathEnv ?? process.env.PATH ?? "";
   for (const dir of pathEnv.split(";").filter(Boolean)) {
     if (!exists(win32Path.join(dir, `${cliId}.cmd`))) continue;
@@ -21893,8 +21979,10 @@ var VnextConfigError = class extends Error {
     this.issues = sorted;
   }
 };
-var PACKAGE_ROOT = resolve2(dirname2(fileURLToPath(import.meta.url)), "../../..");
-var DEFAULT_SCHEMA_DIR = join4(PACKAGE_ROOT, "schemas", "vnext");
+function defaultVnextSchemaDir() {
+  return join6(findKxmRepoRoot(import.meta.url), "schemas", "vnext");
+}
+var DEFAULT_SCHEMA_DIR = defaultVnextSchemaDir();
 var RESOURCE_SCHEMA = Object.freeze({
   project: { identity: "kxm.project.v1", file: "project.schema.json" },
   repository: { identity: "kxm.repository.v1", file: "repository.schema.json" },
@@ -21940,7 +22028,7 @@ function parseRestrictedYaml2(input, label = "<yaml>", limits = VNEXT_YAML_LIMIT
   }
 }
 function readJsonObject(file) {
-  const parsed = JSON.parse(readFileSync4(file, "utf8"));
+  const parsed = JSON.parse(readFileSync5(file, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${file} is not a JSON object`);
   return parsed;
 }
@@ -21957,12 +22045,12 @@ var VnextSchemaRegistry = class {
   permissionDiffValidator;
   runEventValidator;
   constructor(schemasDir = DEFAULT_SCHEMA_DIR) {
-    this.schemasDir = resolve2(schemasDir);
+    this.schemasDir = resolve3(schemasDir);
     this.ajv = new import__.Ajv2020({ allErrors: true, strict: true, strictRequired: false });
-    const common = readJsonObject(join4(this.schemasDir, "common.schema.json"));
+    const common = readJsonObject(join6(this.schemasDir, "common.schema.json"));
     this.ajv.addSchema(common);
     for (const definition of Object.values(RESOURCE_SCHEMA)) {
-      this.ajv.addSchema(readJsonObject(join4(this.schemasDir, definition.file)));
+      this.ajv.addSchema(readJsonObject(join6(this.schemasDir, definition.file)));
     }
     const localBindingsFile = "local-repository-bindings.schema.json";
     const templateProvenanceFile = "template-provenance.schema.json";
@@ -21972,14 +22060,14 @@ var VnextSchemaRegistry = class {
     const migrationReceiptFile = "migration-receipt.schema.json";
     const permissionDiffFile = "permission-diff.schema.json";
     const runEventFile = "run-event.schema.json";
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, localBindingsFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, templateProvenanceFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, initOperationFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, migrationPlanFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, migrationDecisionFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, migrationReceiptFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, permissionDiffFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, runEventFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, localBindingsFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, templateProvenanceFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, initOperationFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, migrationPlanFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, migrationDecisionFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, migrationReceiptFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, permissionDiffFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, runEventFile)));
     for (const [kind, definition] of Object.entries(RESOURCE_SCHEMA)) {
       const validator = this.ajv.getSchema(`https://schemas.kxm.dev/vnext/${definition.file}`);
       if (!validator) throw new Error(`schema did not compile: ${definition.file}`);
@@ -22055,7 +22143,7 @@ function schemaIssue(file, error) {
   return issue2("schema", `schema_${error.keyword}`, file, `${location} ${error.message ?? "is invalid"}${suffix}`);
 }
 function canonicalHostPath(path4) {
-  const resolved = resolve2(path4);
+  const resolved = resolve3(path4);
   try {
     return realpathSync.native(resolved);
   } catch {
@@ -22069,20 +22157,20 @@ function sameHostPath(left, right) {
 }
 function containedHostPath(root, candidate) {
   const path4 = relative(root, candidate);
-  return path4 === "" || !isAbsolute(path4) && path4 !== ".." && !path4.startsWith(`..${sep}`);
+  return path4 === "" || !isAbsolute2(path4) && path4 !== ".." && !path4.startsWith(`..${sep}`);
 }
 function portableBindingIssue(root, pathHint, repositoryId) {
   let current = root;
   for (const segment of pathHint === "." ? [] : pathHint.split("/")) {
-    current = join4(current, segment);
-    if (!existsSync4(current)) break;
+    current = join6(current, segment);
+    if (!existsSync6(current)) break;
     const stat = lstatSync(current);
     if (stat.isSymbolicLink()) {
       return issue2("path", "repository_binding_path_link", ".kxm/project.yaml", `portable pathHint for ${repositoryId} traverses a symbolic link or junction`);
     }
   }
-  const binding = resolve2(root, ...pathHint.split("/"));
-  if (existsSync4(binding)) {
+  const binding = resolve3(root, ...pathHint.split("/"));
+  if (existsSync6(binding)) {
     const realRoot = canonicalHostPath(root);
     const realBinding = canonicalHostPath(binding);
     if (!containedHostPath(realRoot, realBinding)) {
@@ -22119,10 +22207,10 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
     fail2("discovery", "resource_missing", label, "resource does not exist");
   }
   if (stat.isSymbolicLink()) fail2("path", "resource_symlink", label, "configuration resources must not be symbolic links");
-  const boundary = resolve2(containmentRoot);
-  let parent = dirname2(file);
+  const boundary = resolve3(containmentRoot);
+  let parent = dirname4(file);
   while (parent !== boundary) {
-    if (parent === dirname2(parent)) fail2("path", "resource_outside_project", label, "resource escapes the project root");
+    if (parent === dirname4(parent)) fail2("path", "resource_outside_project", label, "resource escapes the project root");
     let parentStat;
     try {
       parentStat = lstatSync(parent);
@@ -22130,33 +22218,33 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
       fail2("discovery", "resource_parent_missing", label, "resource parent does not exist");
     }
     if (parentStat.isSymbolicLink()) fail2("path", "resource_parent_symlink", label, "configuration resource parents must not be symbolic links");
-    parent = dirname2(parent);
+    parent = dirname4(parent);
   }
   if (!stat.isFile()) fail2("path", "resource_not_file", label, "configuration resource must be a regular file");
-  const value = parseRestrictedYaml2(readFileSync4(file), label);
+  const value = parseRestrictedYaml2(readFileSync5(file), label);
   const issues = registry.validate(kind, value, label);
   if (issues.length > 0) throw new VnextConfigError(issues);
   return { kind, ...id === void 0 ? {} : { id }, file, logicalPath, value };
 }
 function readTemplateProvenance(registry, root) {
-  const file = join4(root, ".kxm", "template-provenance.yaml");
-  if (!existsSync4(file)) return void 0;
+  const file = join6(root, ".kxm", "template-provenance.yaml");
+  if (!existsSync6(file)) return void 0;
   const label = ".kxm/template-provenance.yaml";
   const stat = lstatSync(file);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     fail2("path", "resource_not_file", label, "template provenance must be a regular file, not a link or directory");
   }
-  const configRoot = join4(root, ".kxm");
-  let parent = dirname2(file);
+  const configRoot = join6(root, ".kxm");
+  let parent = dirname4(file);
   while (parent !== root) {
     const parentStat = lstatSync(parent);
     if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
       fail2("path", "resource_parent_symlink", label, "template provenance parents must be regular directories");
     }
     if (parent === configRoot) break;
-    parent = dirname2(parent);
+    parent = dirname4(parent);
   }
-  const value = parseRestrictedYaml2(readFileSync4(file), label);
+  const value = parseRestrictedYaml2(readFileSync5(file), label);
   const issues = registry.validateTemplateProvenance(value, label);
   if (issues.length > 0) throw new VnextConfigError(issues);
   if (!resolveVnextTemplateBaseline(value)) {
@@ -22187,7 +22275,7 @@ function readTemplateProvenance(registry, root) {
 }
 function listNamedResources(registry, root, directory, logicalDirectory, kind) {
   const resources = /* @__PURE__ */ new Map();
-  if (!existsSync4(directory)) return resources;
+  if (!existsSync6(directory)) return resources;
   const stat = lstatSync(directory);
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     fail2("path", "resource_directory_invalid", displayPath(root, directory), "resource directory must be a regular directory");
@@ -22196,27 +22284,27 @@ function listNamedResources(registry, root, directory, logicalDirectory, kind) {
   const entries = readdirSync(directory, { withFileTypes: true }).sort((left, right) => compareCodeUnits3(left.name, right.name));
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join4(directory, entry.name)), "nested resource directories are not allowed"));
+      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join6(directory, entry.name)), "nested resource directories are not allowed"));
       continue;
     }
     if (!entry.name.toLowerCase().endsWith(".yaml") && !entry.name.toLowerCase().endsWith(".yml")) continue;
     if (!entry.isFile() || extname(entry.name) !== ".yaml") {
-      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join4(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
+      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join6(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
       continue;
     }
     const id = basename2(entry.name, ".yaml");
     if (kind === "model" && id === "inventory") continue;
     if (!resourceIdentifier(id)) {
-      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join4(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
+      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join6(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
       continue;
     }
     const collision = [...resources.keys()].find((candidate) => candidate.toLocaleLowerCase("en-US") === id.toLocaleLowerCase("en-US"));
     if (collision) {
-      issues.push(issue2("path", "resource_id_collision", displayPath(root, join4(directory, entry.name)), `${id} case-folds to existing ${collision}`));
+      issues.push(issue2("path", "resource_id_collision", displayPath(root, join6(directory, entry.name)), `${id} case-folds to existing ${collision}`));
       continue;
     }
     try {
-      const resource = readResource(registry, root, join4(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
+      const resource = readResource(registry, root, join6(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
       resources.set(id, resource);
     } catch (error) {
       if (error instanceof VnextConfigError) issues.push(...error.issues);
@@ -22537,8 +22625,8 @@ function validateWorkflow(workflow, agents, models, repositories, gates, issues)
       const writable = Object.values(objectValue(step.repositories) ?? {}).filter((access) => access === "write").length;
       if (maxWriteRepositories > writable) issues.push(issue2("semantic", "write_repository_bound_invalid", file, `${stepId} maxWriteRepositories exceeds writable repository scope`));
     }
-    const join48 = objectValue(step.join);
-    const minimumPassed = join48 && typeof join48.minimumPassed === "number" ? join48.minimumPassed : void 0;
+    const join50 = objectValue(step.join);
+    const minimumPassed = join50 && typeof join50.minimumPassed === "number" ? join50.minimumPassed : void 0;
     if (minimumPassed !== void 0 && minimumPassed > maximum) issues.push(issue2("semantic", "join_impossible", file, `${stepId} minimumPassed exceeds assignment maximum`));
     const distinctBy = names(assignment?.distinctBy);
     if (distinctBy.length > 0) {
@@ -22752,11 +22840,11 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   if (!workflows.has(defaultWorkflow)) issues.push(issue2("reference", "default_workflow_unknown", project.logicalPath, `default workflow ${defaultWorkflow} does not exist`));
   for (const workflow of workflows.values()) validateWorkflow(workflow, agents, models, repositoryIds, gates, issues);
   if (projectRoot) {
-    const writerRolePath = join4(projectRoot, ".kxm", "roles", "writer.yaml");
+    const writerRolePath = join6(projectRoot, ".kxm", "roles", "writer.yaml");
     const implementerAgent = agents.get("implementer") ?? agents.get("writer");
-    if (existsSync4(writerRolePath) && implementerAgent) {
+    if (existsSync6(writerRolePath) && implementerAgent) {
       try {
-        const rawRole = parseRestrictedYaml2(readFileSync4(writerRolePath, "utf8"));
+        const rawRole = parseRestrictedYaml2(readFileSync5(writerRolePath, "utf8"));
         const roleObj = objectValue(rawRole);
         const rosterEntries = valuesOf(roleObj ?? {}, "roster").map((candidate) => objectValue(candidate)).filter((entry) => Boolean(entry));
         const enabledRosterModels = rosterEntries.filter((entry) => entry.enabled !== false).map((entry) => stringValue(entry.model)).filter((m2) => Boolean(m2));
@@ -22802,8 +22890,8 @@ function gitEnvironment() {
   return Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("GIT_")));
 }
 function discoverGitRoot(start = process.cwd()) {
-  let current = resolve2(start);
-  if (existsSync4(current) && !lstatSync(current).isDirectory()) current = dirname2(current);
+  let current = resolve3(start);
+  if (existsSync6(current) && !lstatSync(current).isDirectory()) current = dirname4(current);
   const result = spawnSync2("git", ["-C", current, "rev-parse", "--show-toplevel"], {
     encoding: "utf8",
     env: gitEnvironment(),
@@ -22811,12 +22899,12 @@ function discoverGitRoot(start = process.cwd()) {
     windowsHide: true
   });
   if (result.status !== 0 || result.error || !result.stdout.trim()) return void 0;
-  const root = resolve2(result.stdout.trim());
-  return existsSync4(root) && lstatSync(root).isDirectory() ? root : void 0;
+  const root = resolve3(result.stdout.trim());
+  return existsSync6(root) && lstatSync(root).isDirectory() ? root : void 0;
 }
 function discoverVnextProjectRoot(start = process.cwd()) {
   const gitRoot = discoverGitRoot(start);
-  return gitRoot && existsSync4(join4(gitRoot, ".kxm", "project.yaml")) ? gitRoot : void 0;
+  return gitRoot && existsSync6(join6(gitRoot, ".kxm", "project.yaml")) ? gitRoot : void 0;
 }
 function assertNoRegisteredGates(options) {
   if ("registeredGates" in options) {
@@ -22825,7 +22913,7 @@ function assertNoRegisteredGates(options) {
 }
 function loadVnextProject(projectRoot, options = {}) {
   assertNoRegisteredGates(options);
-  const root = resolve2(projectRoot);
+  const root = resolve3(projectRoot);
   let migrationReceipt;
   if (legacyConfigFilesAt(root).length > 0 && options.allowUnreceiptedLegacyConfig !== true) {
     const receiptCheck = readVnextMigrationReceipt(root, options);
@@ -22833,7 +22921,7 @@ function loadVnextProject(projectRoot, options = {}) {
     migrationReceipt = receiptCheck.receipt;
   }
   const registry = new VnextSchemaRegistry(options.schemasDir);
-  const project = readResource(registry, root, join4(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
+  const project = readResource(registry, root, join6(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
   const earlyIssues = [];
   validatePortablePaths(project, earlyIssues);
   const templateProvenance = readTemplateProvenance(registry, root);
@@ -22855,16 +22943,16 @@ function loadVnextProject(projectRoot, options = {}) {
     }
   }
   if (earlyIssues.length > 0) throw new VnextConfigError(earlyIssues);
-  const agents = listNamedResources(registry, root, join4(root, ".kxm", "agents"), ".kxm/agents", "agent");
-  const models = listNamedResources(registry, root, join4(root, ".kxm", "models"), ".kxm/models", "model");
-  const workflows = listNamedResources(registry, root, join4(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
-  const gatePath = join4(root, ".kxm", "gates.yaml");
-  const gateRegistry = existsSync4(gatePath) ? readResource(registry, root, gatePath, ".kxm/gates.yaml", "gate-registry") : void 0;
+  const agents = listNamedResources(registry, root, join6(root, ".kxm", "agents"), ".kxm/agents", "agent");
+  const models = listNamedResources(registry, root, join6(root, ".kxm", "models"), ".kxm/models", "model");
+  const workflows = listNamedResources(registry, root, join6(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
+  const gatePath = join6(root, ".kxm", "gates.yaml");
+  const gateRegistry = existsSync6(gatePath) ? readResource(registry, root, gatePath, ".kxm/gates.yaml", "gate-registry") : void 0;
   const environments = [];
   const repositories = /* @__PURE__ */ new Map();
   const loadIssues = [];
-  const projectEnvironment = join4(root, ".kxm", "project", "env.yaml");
-  if (existsSync4(projectEnvironment)) {
+  const projectEnvironment = join6(root, ".kxm", "project", "env.yaml");
+  if (existsSync6(projectEnvironment)) {
     try {
       environments.push(readResource(registry, root, projectEnvironment, ".kxm/project/env.yaml", "environment"));
     } catch (error) {
@@ -22882,7 +22970,7 @@ function loadVnextProject(projectRoot, options = {}) {
     if (!repositoryId) continue;
     const hasLocalBinding = Object.hasOwn(options.repositoryBindings ?? {}, repositoryId);
     const localBinding = options.repositoryBindings?.[repositoryId];
-    if (hasLocalBinding && (!localBinding || !isAbsolute(localBinding))) {
+    if (hasLocalBinding && (!localBinding || !isAbsolute2(localBinding))) {
       loadIssues.push(issue2("path", "repository_binding_not_absolute", ".kxm/project.yaml", `host-local binding for ${repositoryId} must be absolute`));
       continue;
     }
@@ -22901,12 +22989,12 @@ function loadVnextProject(projectRoot, options = {}) {
         continue;
       }
     }
-    const binding = hasLocalBinding && localBinding ? resolve2(localBinding) : role === "control" ? root : pathHint && portablePath(pathHint) ? resolve2(root, ...pathHint.split("/")) : void 0;
+    const binding = hasLocalBinding && localBinding ? resolve3(localBinding) : role === "control" ? root : pathHint && portablePath(pathHint) ? resolve3(root, ...pathHint.split("/")) : void 0;
     if (!binding) {
       if (required) loadIssues.push(issue2("discovery", "repository_binding_missing", ".kxm/project.yaml", `required repository ${repositoryId} has no portable pathHint or host-local binding`));
       continue;
     }
-    if (!existsSync4(binding)) {
+    if (!existsSync6(binding)) {
       if (required || hasLocalBinding) loadIssues.push(issue2("discovery", "repository_binding_unavailable", ".kxm/project.yaml", `${hasLocalBinding ? "explicit" : "required"} repository binding ${repositoryId} is unavailable`));
       continue;
     }
@@ -22929,9 +23017,9 @@ function loadVnextProject(projectRoot, options = {}) {
       continue;
     }
     seenBindings.set(foldedBinding, repositoryId);
-    const repositoryFile = join4(binding, ".kxm", "repo", "repo.yaml");
+    const repositoryFile = join6(binding, ".kxm", "repo", "repo.yaml");
     let definitionValidated = false;
-    if (existsSync4(repositoryFile)) {
+    if (existsSync6(repositoryFile)) {
       try {
         const resource = readResource(registry, root, repositoryFile, `.kxm/repositories/${repositoryId}/repo.yaml`, "repository", repositoryId, binding);
         if (resource.value.repositoryId !== repositoryId) {
@@ -22947,8 +23035,8 @@ function loadVnextProject(projectRoot, options = {}) {
     } else if (required || hasLocalBinding) {
       loadIssues.push(issue2("discovery", "repository_definition_missing", `.kxm/repositories/${repositoryId}/repo.yaml`, `${hasLocalBinding ? "explicit" : "required"} repository ${repositoryId} has no repo.yaml`));
     }
-    const environmentFile = join4(binding, ".kxm", "repo", "env.yaml");
-    if (existsSync4(environmentFile)) {
+    const environmentFile = join6(binding, ".kxm", "repo", "env.yaml");
+    if (existsSync6(environmentFile)) {
       if (!definitionValidated) {
         loadIssues.push(issue2("reference", "repository_environment_without_definition", `.kxm/repositories/${repositoryId}/env.yaml`, `repository ${repositoryId} environment requires a validated matching repo.yaml`));
       } else {
@@ -23016,7 +23104,7 @@ function verifyVnextMigrationReceiptTarget(root, receipt, resources, configRevis
 }
 function relativePortable(root, absolute) {
   const rel = relative(root, absolute);
-  if (!rel || isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) return void 0;
+  if (!rel || isAbsolute2(rel) || rel === ".." || rel.startsWith(`..${sep}`)) return void 0;
   return rel.split(sep).join("/");
 }
 function legacyInputsAt(root) {
@@ -23026,21 +23114,21 @@ function legacyInputsAt(root) {
     ".kxm/config/workflows",
     ".kxm/state/kxm.db"
   ];
-  return candidates.filter((candidate) => existsSync4(join4(root, ...candidate.split("/"))));
+  return candidates.filter((candidate) => existsSync6(join6(root, ...candidate.split("/"))));
 }
 var VNEXT_MIGRATION_RECEIPT_PATH = ".kxm/migration-receipt.yaml";
 var LEGACY_CONFIG_FILES = [".kxm/config/agents.json", ".kxm/config/gates.json"];
 function legacyConfigFilesAt(root) {
   const files = [];
   for (const component of [".kxm", ".kxm/config"]) {
-    const absolute = join4(root, ...component.split("/"));
-    if (existsSync4(absolute) && lstatSync(absolute).isSymbolicLink()) return [component];
+    const absolute = join6(root, ...component.split("/"));
+    if (existsSync6(absolute) && lstatSync(absolute).isSymbolicLink()) return [component];
   }
   for (const candidate of LEGACY_CONFIG_FILES) {
-    if (existsSync4(join4(root, ...candidate.split("/")))) files.push(candidate);
+    if (existsSync6(join6(root, ...candidate.split("/")))) files.push(candidate);
   }
-  const workflowsDir = join4(root, ".kxm", "config", "workflows");
-  if (existsSync4(workflowsDir)) {
+  const workflowsDir = join6(root, ".kxm", "config", "workflows");
+  if (existsSync6(workflowsDir)) {
     const stat = lstatSync(workflowsDir);
     if (stat.isSymbolicLink()) {
       files.push(".kxm/config/workflows");
@@ -23055,9 +23143,9 @@ function legacyConfigFilesAt(root) {
   return files;
 }
 function hashFileRecord(root, relativePath) {
-  const absolute = join4(root, ...relativePath.split("/"));
-  if (!existsSync4(absolute)) return void 0;
-  const bytes = readFileSync4(absolute);
+  const absolute = join6(root, ...relativePath.split("/"));
+  if (!existsSync6(absolute)) return void 0;
+  const bytes = readFileSync5(absolute);
   return {
     path: relativePath,
     sha256: `sha256:${createHash6("sha256").update(bytes).digest("hex")}`,
@@ -23069,9 +23157,9 @@ function migrationReceiptSelfHash(receipt) {
   return `sha256:${createHash6("sha256").update(vnextCanonicalJson(unsigned), "utf8").digest("hex")}`;
 }
 function readVnextMigrationReceipt(root, options = {}) {
-  const receiptPath = join4(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+  const receiptPath = join6(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
   const legacyFiles = legacyConfigFilesAt(root);
-  if (!existsSync4(receiptPath)) {
+  if (!existsSync6(receiptPath)) {
     return {
       issues: legacyFiles.map((file) => issue2("semantic", "legacy_vnext_conflict", file, "legacy and vNext configuration cannot coexist before an accepted migration receipt"))
     };
@@ -23082,7 +23170,7 @@ function readVnextMigrationReceipt(root, options = {}) {
   }
   let receipt;
   try {
-    receipt = parseRestrictedYaml2(readFileSync4(receiptPath), VNEXT_MIGRATION_RECEIPT_PATH);
+    receipt = parseRestrictedYaml2(readFileSync5(receiptPath), VNEXT_MIGRATION_RECEIPT_PATH);
   } catch (error) {
     if (error instanceof VnextConfigError) return { issues: [...error.issues] };
     throw error;
@@ -23115,14 +23203,14 @@ function readVnextMigrationReceipt(root, options = {}) {
   return issues.length > 0 ? { issues } : { receipt, issues: [] };
 }
 function discoverLegacyRoot(start) {
-  let initial = resolve2(start);
-  if (existsSync4(initial) && !lstatSync(initial).isDirectory()) initial = dirname2(initial);
+  let initial = resolve3(start);
+  if (existsSync6(initial) && !lstatSync(initial).isDirectory()) initial = dirname4(initial);
   const candidate = discoverGitRoot(initial) ?? initial;
   const inputs = legacyInputsAt(candidate);
   return inputs.length > 0 ? { root: candidate, inputs } : void 0;
 }
 function planVnextInitialization(start = process.cwd(), options = {}) {
-  const inspectedFrom = resolve2(start);
+  const inspectedFrom = resolve3(start);
   const projectRoot = discoverVnextProjectRoot(inspectedFrom);
   if (projectRoot) {
     try {
@@ -23143,7 +23231,7 @@ function planVnextInitialization(start = process.cwd(), options = {}) {
   }
   const gitRoot = discoverGitRoot(inspectedFrom);
   const candidateRoot = gitRoot ?? inspectedFrom;
-  if (existsSync4(join4(candidateRoot, ".kxm"))) {
+  if (existsSync6(join6(candidateRoot, ".kxm"))) {
     return {
       mode: "repair",
       inspectedFrom,
@@ -23159,14 +23247,13 @@ function planVnextInitialization(start = process.cwd(), options = {}) {
 // plugins/kxm/src/vnext-runtime-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash11, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join10, resolve as resolve7 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { chmodSync as chmodSync4, existsSync as existsSync12, lstatSync as lstatSync6, mkdirSync as mkdirSync8, readFileSync as readFileSync11, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname8, isAbsolute as isAbsolute5, join as join12 } from "node:path";
 
 // plugins/kxm/src/vnext-runtime-store.ts
 import { createHash as createHash9, randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync7, realpathSync as realpathSync3, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname5, join as join7, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync9, lstatSync as lstatSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync8, realpathSync as realpathSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, join as join9, resolve as resolve6 } from "node:path";
 
 // plugins/kxm/src/vnext-bindings.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -23174,18 +23261,18 @@ import { createHash as createHash7, randomUUID as randomUUID3 } from "node:crypt
 import {
   chmodSync as chmodSync2,
   closeSync,
-  existsSync as existsSync5,
+  existsSync as existsSync7,
   fsyncSync,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
   openSync,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   realpathSync as realpathSync2,
-  renameSync,
-  rmSync,
-  writeFileSync as writeFileSync3
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 
 // plugins/kxm/src/sqlite.ts
 import { createRequire } from "node:module";
@@ -23227,7 +23314,7 @@ var DatabaseSync = class {
 };
 
 // plugins/kxm/src/vnext-bindings.ts
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join5, parse, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join7, parse, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
 var MAX_BINDING_RECORD_BYTES = 256 * 1024;
 var BINDING_LABEL = "Runtime-local repository bindings";
 var activeLocks = /* @__PURE__ */ new WeakSet();
@@ -23238,7 +23325,7 @@ function bindingError(phase, code, message) {
   throw new VnextConfigError([bindingIssue(phase, code, message)]);
 }
 function canonicalHostPath2(path4) {
-  const absolute = resolve3(path4);
+  const absolute = resolve4(path4);
   try {
     return realpathSync2.native(absolute);
   } catch {
@@ -23253,21 +23340,21 @@ function sameHostPath2(left, right, platform = process.platform) {
 function vnextUserStateRoot(options = {}) {
   const env = options.env ?? process.env;
   const platform = options.platform ?? process.platform;
-  const home = options.homeDir ?? homedir2();
+  const home = options.homeDir ?? homedir3();
   const explicit = options.stateRoot ?? env.KXM_STATE_HOME?.trim();
   if (explicit) {
-    if (!isAbsolute2(explicit)) bindingError("path", "local_state_root_not_absolute", "KXM_STATE_HOME must be an absolute host-local path");
-    return resolve3(explicit);
+    if (!isAbsolute3(explicit)) bindingError("path", "local_state_root_not_absolute", "KXM_STATE_HOME must be an absolute host-local path");
+    return resolve4(explicit);
   }
   if (platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join5(home, "AppData", "Local");
-    return resolve3(base2, "KXM");
+    const base2 = localAppData && isAbsolute3(localAppData) ? localAppData : join7(home, "AppData", "Local");
+    return resolve4(base2, "KXM");
   }
-  if (platform === "darwin") return resolve3(home, "Library", "Application Support", "KXM");
+  if (platform === "darwin") return resolve4(home, "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join5(home, ".local", "state");
-  return resolve3(base, "kxm");
+  const base = xdgState && isAbsolute3(xdgState) ? xdgState : join7(home, ".local", "state");
+  return resolve4(base, "kxm");
 }
 function projectBindingKey(projectRoot, platform = process.platform) {
   const canonical2 = canonicalHostPath2(projectRoot);
@@ -23276,10 +23363,10 @@ function projectBindingKey(projectRoot, platform = process.platform) {
 }
 function vnextLocalBindingFile(projectRoot, options = {}) {
   const stateRoot = vnextUserStateRoot(options);
-  return join5(stateRoot, "projects", projectBindingKey(projectRoot, options.platform), "repository-bindings.json");
+  return join7(stateRoot, "projects", projectBindingKey(projectRoot, options.platform), "repository-bindings.json");
 }
 function checkedDirectory(path4, description) {
-  if (!existsSync5(path4)) return false;
+  if (!existsSync7(path4)) return false;
   const stat = lstatSync2(path4);
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     bindingError("path", "local_binding_directory_invalid", `${description} must be a regular directory, not a link or file`);
@@ -23287,8 +23374,8 @@ function checkedDirectory(path4, description) {
   return true;
 }
 function existingBindingDirectory(file, stateRoot) {
-  const projects = join5(stateRoot, "projects");
-  const project = dirname3(file);
+  const projects = join7(stateRoot, "projects");
+  const project = dirname5(file);
   if (!checkedDirectory(stateRoot, "local state root")) return false;
   if (!checkedDirectory(projects, "local projects directory")) return false;
   return checkedDirectory(project, "local project binding directory");
@@ -23311,10 +23398,10 @@ function asRecord2(value, file, projectRoot, schemasDir) {
   };
 }
 function readVnextLocalBindings(projectRoot, options = {}) {
-  const root = resolve3(projectRoot);
+  const root = resolve4(projectRoot);
   const stateRoot = vnextUserStateRoot(options);
   const file = vnextLocalBindingFile(root, options);
-  if (!existingBindingDirectory(file, stateRoot) || !existsSync5(file)) return void 0;
+  if (!existingBindingDirectory(file, stateRoot) || !existsSync7(file)) return void 0;
   const stat = lstatSync2(file);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     bindingError("path", "local_binding_file_invalid", "binding record must be a regular file, not a link or directory");
@@ -23322,12 +23409,12 @@ function readVnextLocalBindings(projectRoot, options = {}) {
   if (stat.size > MAX_BINDING_RECORD_BYTES) {
     bindingError("parse", "local_binding_file_too_large", `binding record exceeds ${MAX_BINDING_RECORD_BYTES} bytes`);
   }
-  const parsed = parseRestrictedYaml2(readFileSync5(file), BINDING_LABEL);
+  const parsed = parseRestrictedYaml2(readFileSync6(file), BINDING_LABEL);
   return asRecord2(parsed, file, root, options.schemasDir);
 }
 function normalizedRecord(projectRoot, projectId, repositories, schemasDir) {
   const normalizedRepositories = Object.fromEntries(Object.entries(repositories).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([repositoryId, path4]) => {
-    if (!isAbsolute2(path4)) bindingError("path", "repository_binding_not_absolute", `host-local binding for ${repositoryId} must be absolute`);
+    if (!isAbsolute3(path4)) bindingError("path", "repository_binding_not_absolute", `host-local binding for ${repositoryId} must be absolute`);
     return [repositoryId, canonicalHostPath2(path4)];
   }));
   const value = {
@@ -23362,48 +23449,48 @@ function syncDirectory(path4) {
   }
 }
 function createDirectoryIfMissing(path4) {
-  if (existsSync5(path4)) return;
+  if (existsSync7(path4)) return;
   try {
-    mkdirSync3(path4, { mode: 448 });
-    syncDirectory(dirname3(path4));
+    mkdirSync4(path4, { mode: 448 });
+    syncDirectory(dirname5(path4));
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
   }
 }
 function ensureDurableDirectory(path4, description) {
   const missing = [];
-  let current = resolve3(path4);
-  while (!existsSync5(current)) {
+  let current = resolve4(path4);
+  while (!existsSync7(current)) {
     missing.push(current);
-    const parent = dirname3(current);
+    const parent = dirname5(current);
     if (parent === current) bindingError("path", "local_binding_directory_invalid", `${description} has no existing filesystem ancestor`);
     current = parent;
   }
   checkedDirectory(current, `${description} ancestor`);
   for (const directory of missing.reverse()) {
-    mkdirSync3(directory, { mode: 448 });
+    mkdirSync4(directory, { mode: 448 });
     checkedDirectory(directory, description);
-    syncDirectory(dirname3(directory));
+    syncDirectory(dirname5(directory));
   }
 }
 function ensureBindingDirectory(file, stateRoot) {
   ensureDurableDirectory(stateRoot, "local state root");
   checkedDirectory(stateRoot, "local state root");
   syncDirectory(stateRoot);
-  const projects = join5(stateRoot, "projects");
+  const projects = join7(stateRoot, "projects");
   createDirectoryIfMissing(projects);
   checkedDirectory(projects, "local projects directory");
-  const project = dirname3(file);
+  const project = dirname5(file);
   createDirectoryIfMissing(project);
   checkedDirectory(project, "local project binding directory");
 }
 function assertNoLinkedDirectoryComponents(path4, description) {
-  const absolute = resolve3(path4);
+  const absolute = resolve4(path4);
   const filesystemRoot = parse(absolute).root;
   let current = filesystemRoot;
   const remainder = relative2(filesystemRoot, absolute);
   for (const segment of remainder.split(sep2).filter(Boolean)) {
-    current = join5(current, segment);
+    current = join7(current, segment);
     const stat = lstatSync2(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       bindingError("path", "project_operation_lock_parent_invalid", `${description} contains a linked or non-directory component`);
@@ -23424,28 +23511,28 @@ function projectOperationLockFile(projectRoot) {
   if (result.status !== 0 || result.error || !result.stdout.trim()) {
     bindingError("discovery", "project_operation_lock_unavailable", "cannot resolve the authoritative Git metadata path for project locking");
   }
-  const gitDirectory = resolve3(result.stdout.trim());
+  const gitDirectory = resolve4(result.stdout.trim());
   assertNoLinkedDirectoryComponents(gitDirectory, "authoritative Git metadata path");
   const gitStat = lstatSync2(gitDirectory);
   if (gitStat.isSymbolicLink() || !gitStat.isDirectory()) {
     bindingError("path", "project_operation_lock_parent_invalid", "authoritative Git metadata must resolve to a regular directory");
   }
-  const lockDirectory = join5(gitDirectory, "kxm");
-  if (existsSync5(lockDirectory)) {
+  const lockDirectory = join7(gitDirectory, "kxm");
+  if (existsSync7(lockDirectory)) {
     const stat = lstatSync2(lockDirectory);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       bindingError("path", "project_operation_lock_parent_invalid", "Git-local KXM lock directory must be regular, not a link or file");
     }
   } else {
-    mkdirSync3(lockDirectory, { mode: 448 });
+    mkdirSync4(lockDirectory, { mode: 448 });
     syncDirectory(gitDirectory);
   }
-  return join5(lockDirectory, "project-operation-lock.sqlite");
+  return join7(lockDirectory, "project-operation-lock.sqlite");
 }
 function withVnextLocalBindingLock(projectRoot, options, callback) {
-  const root = resolve3(projectRoot);
+  const root = resolve4(projectRoot);
   const file = projectOperationLockFile(root);
-  if (existsSync5(file)) {
+  if (existsSync7(file)) {
     const stat = lstatSync2(file);
     if (stat.isSymbolicLink() || !stat.isFile()) {
       bindingError("path", "local_binding_lock_invalid", "project-operation lock must be a regular file, not a link or directory");
@@ -23478,7 +23565,7 @@ function withVnextLocalBindingLock(projectRoot, options, callback) {
   }
 }
 function planVnextLocalBindings(projectRoot, projectId, repositories, options = {}) {
-  const root = resolve3(projectRoot);
+  const root = resolve4(projectRoot);
   const file = vnextLocalBindingFile(root, options);
   const record = normalizedRecord(root, projectId, repositories, options.schemasDir);
   const existing = readVnextLocalBindings(root, options);
@@ -23488,7 +23575,7 @@ function planVnextLocalBindings(projectRoot, projectId, repositories, options =
   return { file, written: !existing || !recordsEqual(existing, record), record };
 }
 function writeVnextLocalBindings(projectRoot, projectId, repositories, options = {}, lock) {
-  const root = resolve3(projectRoot);
+  const root = resolve4(projectRoot);
   if (!lock) {
     return withVnextLocalBindingLock(root, options, (acquired) => writeVnextLocalBindings(root, projectId, repositories, options, acquired));
   }
@@ -23499,20 +23586,20 @@ function writeVnextLocalBindings(projectRoot, projectId, repositories, options =
   const { file, record } = planned;
   if (!planned.written) return planned;
   ensureBindingDirectory(file, vnextUserStateRoot(options));
-  const temporary = join5(dirname3(file), `.repository-bindings-${process.pid}-${randomUUID3()}.tmp`);
+  const temporary = join7(dirname5(file), `.repository-bindings-${process.pid}-${randomUUID3()}.tmp`);
   let descriptor;
   try {
     descriptor = openSync(temporary, "wx", 384);
-    writeFileSync3(descriptor, `${JSON.stringify(record, null, 2)}
+    writeFileSync4(descriptor, `${JSON.stringify(record, null, 2)}
 `, "utf8");
     fsyncSync(descriptor);
     closeSync(descriptor);
     descriptor = void 0;
-    renameSync(temporary, file);
-    syncDirectory(dirname3(file));
+    renameSync2(temporary, file);
+    syncDirectory(dirname5(file));
   } finally {
     if (descriptor !== void 0) closeSync(descriptor);
-    rmSync(temporary, { force: true });
+    rmSync2(temporary, { force: true });
   }
   const verified = readVnextLocalBindings(root, options);
   if (!verified || !recordsEqual(verified, record)) {
@@ -23526,22 +23613,22 @@ import { createHash as createHash8, randomBytes } from "node:crypto";
 import {
   chmodSync as chmodSync3,
   copyFileSync,
-  existsSync as existsSync6,
+  existsSync as existsSync8,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "node:fs";
-import { basename as basename3, dirname as dirname4, join as join6, resolve as resolve4 } from "node:path";
+import { basename as basename3, dirname as dirname6, join as join8, resolve as resolve5 } from "node:path";
 function databaseError(code, file, message) {
   const issue3 = { phase: "semantic", code, file, message };
   return new VnextConfigError([issue3]);
 }
 function checkedParent(path4, description) {
-  const parent = dirname4(path4);
-  if (!existsSync6(parent)) mkdirSync4(parent, { recursive: true, mode: 448 });
+  const parent = dirname6(path4);
+  if (!existsSync8(parent)) mkdirSync5(parent, { recursive: true, mode: 448 });
   const stat = lstatSync3(parent, { throwIfNoEntry: false });
   if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
     throw databaseError("runtime_path_invalid", description, `${description} parent must be a regular directory, not a link`);
@@ -23683,18 +23770,18 @@ function checkIntegrity(database) {
   return rows.length === 1 && rows[0]?.integrity_check === "ok";
 }
 function fileSha256(filePath) {
-  const bytes = readFileSync6(filePath);
+  const bytes = readFileSync7(filePath);
   return `sha256:${createHash8("sha256").update(bytes).digest("hex")}`;
 }
 function backupDatabaseFile(sourcePath, targetPath, storeId) {
-  const resolvedSource = resolve4(sourcePath);
-  const resolvedTarget = resolve4(targetPath);
+  const resolvedSource = resolve5(sourcePath);
+  const resolvedTarget = resolve5(targetPath);
   const sourceStat = lstatSync3(resolvedSource, { throwIfNoEntry: false });
   if (!sourceStat || !sourceStat.isFile() || sourceStat.isSymbolicLink()) {
     throw databaseError("runtime_path_invalid", resolvedSource, `source database ${resolvedSource} must be a regular file, not a link or directory`);
   }
   checkedParent(resolvedTarget, "backup target");
-  if (existsSync6(resolvedTarget)) {
+  if (existsSync8(resolvedTarget)) {
     unlinkSync2(resolvedTarget);
   }
   const sourceDb = new DatabaseSync(resolvedSource);
@@ -23738,8 +23825,8 @@ function backupDatabaseFile(sourcePath, targetPath, storeId) {
   };
 }
 function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVersion, maxSupportedVersion) {
-  const resolvedBackup = resolve4(backupPath);
-  const resolvedTarget = resolve4(targetPath);
+  const resolvedBackup = resolve5(backupPath);
+  const resolvedTarget = resolve5(targetPath);
   const backupStat = lstatSync3(resolvedBackup, { throwIfNoEntry: false });
   if (!backupStat || !backupStat.isFile() || backupStat.isSymbolicLink()) {
     throw databaseError("runtime_path_invalid", resolvedBackup, `backup database ${resolvedBackup} must be a regular file, not a link or directory`);
@@ -23772,7 +23859,7 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
   }
   checkedParent(resolvedTarget, "restore target");
   for (const file of [resolvedTarget, `${resolvedTarget}-wal`, `${resolvedTarget}-shm`]) {
-    if (existsSync6(file)) {
+    if (existsSync8(file)) {
       try {
         unlinkSync2(file);
       } catch {
@@ -23802,29 +23889,29 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
   };
 }
 function discoverProjectStores(projectRoot, options = {}) {
-  const root = resolve4(projectRoot);
+  const root = resolve5(projectRoot);
   const stores = [];
-  const hubPath = options.hubDataPath ? resolve4(options.hubDataPath) : join6(root, ".kxm", "state", "kxm.db");
-  if (existsSync6(hubPath)) {
+  const hubPath = options.hubDataPath ? resolve5(options.hubDataPath) : join8(root, ".kxm", "state", "kxm.db");
+  if (existsSync8(hubPath)) {
     stores.push({ storeId: "hub-store", sourcePath: hubPath, maxSupportedVersion: 3 });
   }
-  const registryPath = join6(root, ".kxm", "runtime", "registry.db");
-  if (existsSync6(registryPath)) {
+  const registryPath = join8(root, ".kxm", "runtime", "registry.db");
+  if (existsSync8(registryPath)) {
     stores.push({ storeId: "registry", sourcePath: registryPath, maxSupportedVersion: 1 });
   }
-  const bindingsPath = join6(root, ".kxm", "runtime", "bindings.db");
-  if (existsSync6(bindingsPath)) {
+  const bindingsPath = join8(root, ".kxm", "runtime", "bindings.db");
+  if (existsSync8(bindingsPath)) {
     stores.push({ storeId: "binding-store", sourcePath: bindingsPath, maxSupportedVersion: 1 });
   }
-  const eventsDir = join6(root, ".kxm", "runtime", "events");
-  if (existsSync6(eventsDir)) {
+  const eventsDir = join8(root, ".kxm", "runtime", "events");
+  if (existsSync8(eventsDir)) {
     const entries = readdirSync2(eventsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".db")) {
         const key = entry.name.replace(/\.db$/, "");
         stores.push({
           storeId: `events:${key}`,
-          sourcePath: join6(eventsDir, entry.name),
+          sourcePath: join8(eventsDir, entry.name),
           maxSupportedVersion: 3
         });
       }
@@ -23833,7 +23920,7 @@ function discoverProjectStores(projectRoot, options = {}) {
   return stores;
 }
 function createBackup(options = {}) {
-  const projectRoot = options.projectRoot ? resolve4(options.projectRoot) : process.cwd();
+  const projectRoot = options.projectRoot ? resolve5(options.projectRoot) : process.cwd();
   const stores = discoverProjectStores(projectRoot, {
     ...options.hubDataPath !== void 0 ? { hubDataPath: options.hubDataPath } : {}
   });
@@ -23843,9 +23930,9 @@ function createBackup(options = {}) {
   const now = /* @__PURE__ */ new Date();
   const timestamp = now.toISOString().replace(/[:.]/g, "-");
   const backupId = `bk_${randomBytes(8).toString("hex")}`;
-  const outDir = options.outDir ? resolve4(options.outDir) : join6(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
-  if (!existsSync6(outDir)) {
-    mkdirSync4(outDir, { recursive: true, mode: 448 });
+  const outDir = options.outDir ? resolve5(options.outDir) : join8(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
+  if (!existsSync8(outDir)) {
+    mkdirSync5(outDir, { recursive: true, mode: 448 });
   }
   const backedUpStores = [];
   const usedFilenames = /* @__PURE__ */ new Set();
@@ -23856,7 +23943,7 @@ function createBackup(options = {}) {
       filename = `${sanitizedId}-${filename}`;
     }
     usedFilenames.add(filename);
-    const targetFile2 = join6(outDir, filename);
+    const targetFile2 = join8(outDir, filename);
     const record = backupDatabaseFile(store.sourcePath, targetFile2, store.storeId);
     backedUpStores.push(record);
   }
@@ -23871,24 +23958,24 @@ function createBackup(options = {}) {
   const manifestSha256 = `sha256:${createHash8("sha256").update(manifestJson, "utf8").digest("hex")}`;
   manifest.manifestSha256 = manifestSha256;
   const finalJson = JSON.stringify(manifest, null, 2) + "\n";
-  const manifestPath = join6(outDir, "manifest.json");
-  writeFileSync4(manifestPath, finalJson, "utf8");
+  const manifestPath = join8(outDir, "manifest.json");
+  writeFileSync5(manifestPath, finalJson, "utf8");
   return { manifest, outDir };
 }
 function restoreBackup(manifestPathOrDir, options = {}) {
-  let manifestPath = resolve4(manifestPathOrDir);
+  let manifestPath = resolve5(manifestPathOrDir);
   const stat = lstatSync3(manifestPath, { throwIfNoEntry: false });
   if (!stat) {
     throw databaseError("runtime_path_invalid", manifestPath, `manifest path ${manifestPath} does not exist`);
   }
   if (stat.isDirectory()) {
-    manifestPath = join6(manifestPath, "manifest.json");
+    manifestPath = join8(manifestPath, "manifest.json");
   }
-  if (!existsSync6(manifestPath)) {
+  if (!existsSync8(manifestPath)) {
     throw databaseError("runtime_path_invalid", manifestPath, `backup manifest ${manifestPath} not found`);
   }
-  const manifestDir = dirname4(manifestPath);
-  const rawText = readFileSync6(manifestPath, "utf8");
+  const manifestDir = dirname6(manifestPath);
+  const rawText = readFileSync7(manifestPath, "utf8");
   let manifest;
   try {
     manifest = JSON.parse(rawText);
@@ -23900,8 +23987,8 @@ function restoreBackup(manifestPathOrDir, options = {}) {
   }
   const restoredStores = [];
   for (const store of manifest.stores) {
-    const backupFilePath = join6(manifestDir, store.backupFile);
-    if (!existsSync6(backupFilePath)) {
+    const backupFilePath = join8(manifestDir, store.backupFile);
+    if (!existsSync8(backupFilePath)) {
       throw databaseError("restore_file_missing", backupFilePath, `backup file ${store.backupFile} missing from ${manifestDir}`);
     }
     const actualSha256 = fileSha256(backupFilePath);
@@ -23919,7 +24006,7 @@ function restoreBackup(manifestPathOrDir, options = {}) {
     let targetPath = store.sourcePath;
     if (options.projectRoot && manifest.projectRoot && targetPath.startsWith(manifest.projectRoot)) {
       const rel = targetPath.slice(manifest.projectRoot.length).replace(/^[\\/]+/, "");
-      targetPath = join6(resolve4(options.projectRoot), rel);
+      targetPath = join8(resolve5(options.projectRoot), rel);
     }
     const result = restoreDatabaseFile(
       backupFilePath,
@@ -23939,13 +24026,13 @@ function restoreBackup(manifestPathOrDir, options = {}) {
 
 // plugins/kxm/src/vnext-runtime-store.ts
 function vnextRuntimePaths(options = {}) {
-  const stateRoot = options.stateRoot ? resolve5(options.stateRoot) : vnextUserStateRoot({ ...options.env ? { env: options.env } : {}, ...options.homeDir ? { homeDir: options.homeDir } : {} });
-  const runtimeDir = join7(stateRoot, "runtime");
+  const stateRoot = options.stateRoot ? resolve6(options.stateRoot) : vnextUserStateRoot({ ...options.env ? { env: options.env } : {}, ...options.homeDir ? { homeDir: options.homeDir } : {} });
+  const runtimeDir = join9(stateRoot, "runtime");
   return {
     stateRoot,
     runtimeDir,
-    registryDb: join7(runtimeDir, "registry.db"),
-    projectsDir: join7(runtimeDir, "projects")
+    registryDb: join9(runtimeDir, "registry.db"),
+    projectsDir: join9(runtimeDir, "projects")
   };
 }
 function runtimeIssue(phase, code, file, message) {
@@ -23957,9 +24044,9 @@ function runtimeError(code, file, message) {
 function projectRuntimeKey(projectRoot) {
   let canonical2;
   try {
-    canonical2 = realpathSync3.native(resolve5(projectRoot));
+    canonical2 = realpathSync3.native(resolve6(projectRoot));
   } catch {
-    canonical2 = resolve5(projectRoot);
+    canonical2 = resolve6(projectRoot);
   }
   const folded = process.platform === "win32" ? canonical2.toLocaleLowerCase("en-US") : canonical2;
   return createHash9("sha256").update(folded, "utf8").digest("hex").slice(0, 24);
@@ -23993,7 +24080,7 @@ var VnextRuntimeRegistry = class {
   path;
   database;
   constructor(path4) {
-    this.path = resolve5(path4);
+    this.path = resolve6(path4);
     this.database = openDatabase(this.path, "runtime registry", {
       schema: REGISTRY_SCHEMA,
       version: VNEXT_REGISTRY_SCHEMA_VERSION,
@@ -24083,7 +24170,7 @@ var VnextRuntimeRegistry = class {
   }
   /** Register or revalidate a project's home binding. Home Runtime is immutable. */
   registerProject(registration) {
-    const projectRoot = resolve5(registration.projectRoot);
+    const projectRoot = resolve6(registration.projectRoot);
     const projectKey = projectRuntimeKey(projectRoot);
     this.database.exec("BEGIN IMMEDIATE");
     try {
@@ -24304,7 +24391,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
   const maxAttempts = compileCountField(step.maxAttempts, 1, `${id}.maxAttempts`, id, sink);
   const timeoutMs = compileOptionalDuration(step.timeoutMs, `${id}.timeoutMs`, id, sink);
   const assignments = compileAssignments(step, id, agent, sink);
-  const join48 = compileJoin(step, id, sink);
+  const join50 = compileJoin(step, id, sink);
   const requiredEvidence = compileEvidence(step, id, sink);
   const transitions = compileTransitions(step, id, index, stepIndex, sink);
   const outcomes = Object.keys(transitions).sort(compareCodeUnits4);
@@ -24332,7 +24419,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
     transitions: orderedTransitions,
     requiresPlanHash: requirePlanHash.includes(id),
     assignments,
-    join: join48
+    join: join50
   };
   if (kind === "agent" || kind === "moa") {
     if (!agent) return void 0;
@@ -24382,15 +24469,15 @@ function compileAssignments(step, stepId, primaryAgentId, sink) {
   };
 }
 function compileJoin(step, stepId, sink) {
-  const join48 = objectValue2(step.join);
-  if (!join48) return { strategy: "all" };
-  const declared = stringValue2(join48.strategy);
+  const join50 = objectValue2(step.join);
+  if (!join50) return { strategy: "all" };
+  const declared = stringValue2(join50.strategy);
   const strategy = declared && JOIN_STRATEGIES.has(declared) ? declared : "all";
-  const minimumPassed = compileOptionalCount(join48.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
+  const minimumPassed = compileOptionalCount(join50.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
   const compiled = {
     strategy,
     ...minimumPassed !== void 0 ? { minimumPassed } : {},
-    ...typeof join48.cancelRemaining === "boolean" ? { cancelRemaining: join48.cancelRemaining } : {}
+    ...typeof join50.cancelRemaining === "boolean" ? { cancelRemaining: join50.cancelRemaining } : {}
   };
   return compiled;
 }
@@ -24670,8 +24757,8 @@ var RECORD_LIMIT = 16 * 1024 * 1024;
 // plugins/kxm/src/prices.ts
 var import_yaml3 = __toESM(require_dist(), 1);
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync8, statSync } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync9, statSync } from "node:fs";
+import { join as join10 } from "node:path";
 
 // plugins/kxm/src/price-calc.ts
 var PRICES_SCHEMA = "kxm.prices.v1";
@@ -24823,11 +24910,11 @@ function parsePriceCatalog(text) {
   return catalog;
 }
 function loadPriceCatalog(rootOrPath) {
-  const candidatePath = existsSync8(join8(rootOrPath, ".kxm", "prices.yaml")) ? join8(rootOrPath, ".kxm", "prices.yaml") : existsSync8(join8(rootOrPath, "prices.yaml")) ? join8(rootOrPath, "prices.yaml") : existsSync8(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
-  if (!candidatePath || !existsSync8(candidatePath)) {
+  const candidatePath = existsSync10(join10(rootOrPath, ".kxm", "prices.yaml")) ? join10(rootOrPath, ".kxm", "prices.yaml") : existsSync10(join10(rootOrPath, "prices.yaml")) ? join10(rootOrPath, "prices.yaml") : existsSync10(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
+  if (!candidatePath || !existsSync10(candidatePath)) {
     return void 0;
   }
-  const content = readFileSync8(candidatePath, "utf8");
+  const content = readFileSync9(candidatePath, "utf8");
   return parsePriceCatalog(content);
 }
 function loadPriceCatalogForEstimate(options) {
@@ -24848,13 +24935,13 @@ var import_yaml5 = __toESM(require_dist(), 1);
 
 // plugins/kxm/src/producers.ts
 var import_yaml4 = __toESM(require_dist(), 1);
-import { existsSync as existsSync9, readFileSync as readFileSync9, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readdirSync as readdirSync3 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, readdirSync as readdirSync3 } from "node:fs";
+import { join as join11 } from "node:path";
 var empty = () => ({ schema: "kxm.producers.v1", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), promoted: [], demoted: [], enabled: [], disabled: [], roles: {} });
 function loadProducerPolicy(root) {
-  const path4 = join9(root, ".kxm", "producers.yaml");
-  if (!existsSync9(path4)) return empty();
-  const value = (0, import_yaml4.parse)(readFileSync9(path4, "utf8"));
+  const path4 = join11(root, ".kxm", "producers.yaml");
+  if (!existsSync11(path4)) return empty();
+  const value = (0, import_yaml4.parse)(readFileSync10(path4, "utf8"));
   if (value?.schema !== "kxm.producers.v1" || !Array.isArray(value.promoted) || !Array.isArray(value.demoted)) throw new Error("invalid .kxm/producers.yaml");
   return { schema: "kxm.producers.v1", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), promoted: value.promoted.filter((x2) => typeof x2 === "string"), demoted: value.demoted.filter((x2) => typeof x2 === "string"), enabled: Array.isArray(value.enabled) ? value.enabled.filter((x2) => typeof x2 === "string") : [], disabled: Array.isArray(value.disabled) ? value.disabled.filter((x2) => typeof x2 === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v2]) => Array.isArray(v2)).map(([k, v2]) => [k, v2.filter((x2) => typeof x2 === "string")])) : {} };
 }
@@ -24864,8 +24951,8 @@ function updateProducer(root, model, status) {
   policy.demoted = policy.demoted.filter((x2) => x2 !== model);
   policy[status].push(model);
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync6(join9(root, ".kxm"), { recursive: true });
-  writeFileSync6(join9(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
+  mkdirSync7(join11(root, ".kxm"), { recursive: true });
+  writeFileSync7(join11(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
   return policy;
 }
 function setModelState(root, model, state, role, removeRole2 = false) {
@@ -24875,10 +24962,10 @@ function setModelState(root, model, state, role, removeRole2 = false) {
   policy[state].push(model);
   if (role) {
     if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(role)) throw new Error("invalid role id");
-    const rolePath = join9(root, ".kxm", "roles", `${role}.yaml`);
+    const rolePath = join11(root, ".kxm", "roles", `${role}.yaml`);
     let roleFile = {};
-    if (existsSync9(rolePath)) {
-      const parsed = (0, import_yaml4.parse)(readFileSync9(rolePath, "utf8"));
+    if (existsSync11(rolePath)) {
+      const parsed = (0, import_yaml4.parse)(readFileSync10(rolePath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) roleFile = parsed;
     }
     const roster = Array.isArray(roleFile.roster) ? roleFile.roster.filter((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)) : [];
@@ -24889,42 +24976,42 @@ function setModelState(root, model, state, role, removeRole2 = false) {
     roleFile.schema ??= "kxm.role.v1";
     roleFile.id ??= role;
     roleFile.roster = roster;
-    mkdirSync6(join9(root, ".kxm", "roles"), { recursive: true });
-    writeFileSync6(rolePath, (0, import_yaml4.stringify)(roleFile), "utf8");
+    mkdirSync7(join11(root, ".kxm", "roles"), { recursive: true });
+    writeFileSync7(rolePath, (0, import_yaml4.stringify)(roleFile), "utf8");
   }
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync6(join9(root, ".kxm"), { recursive: true });
-  writeFileSync6(join9(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
+  mkdirSync7(join11(root, ".kxm"), { recursive: true });
+  writeFileSync7(join11(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
   return policy;
 }
 function listRoleBindings(root) {
-  const dir = join9(root, ".kxm", "roles");
+  const dir = join11(root, ".kxm", "roles");
   const result = {};
-  if (!existsSync9(dir)) return result;
+  if (!existsSync11(dir)) return result;
   for (const file of readdirSync3(dir).filter((name) => name.endsWith(".yaml"))) {
     const role = file.slice(0, -5);
-    const value = (0, import_yaml4.parse)(readFileSync9(join9(dir, file), "utf8"));
+    const value = (0, import_yaml4.parse)(readFileSync10(join11(dir, file), "utf8"));
     result[role] = (value.roster ?? []).map((entry) => entry.model).filter((model) => typeof model === "string");
   }
   return result;
 }
 function listInventoryModels(root) {
-  const path4 = join9(root, ".kxm", "models", "inventory.yaml");
-  if (!existsSync9(path4)) return [];
-  const value = (0, import_yaml4.parse)(readFileSync9(path4, "utf8"));
+  const path4 = join11(root, ".kxm", "models", "inventory.yaml");
+  if (!existsSync11(path4)) return [];
+  const value = (0, import_yaml4.parse)(readFileSync10(path4, "utf8"));
   return (value.models ?? []).map((m2) => m2.id).filter((id) => typeof id === "string");
 }
 
 // plugins/kxm/src/artifacts-exist.ts
 import { lstatSync as lstatSync5, realpathSync as realpathSync4, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute4, relative as relative3, resolve as resolve7 } from "node:path";
 function staysUnder(root, candidate) {
   const child = relative3(root, candidate);
-  return child === "" || !isAbsolute3(child) && child !== ".." && !child.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
+  return child === "" || !isAbsolute4(child) && child !== ".." && !child.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
 }
 function verifyArtifactExists(rootInput, pathInput) {
-  const lexicalRoot = resolve6(rootInput);
-  const lexicalPath = resolve6(pathInput);
+  const lexicalRoot = resolve7(rootInput);
+  const lexicalPath = resolve7(pathInput);
   if (!staysUnder(lexicalRoot, lexicalPath)) {
     return { ok: false, error: "artifact_outside_workspace_assets", path: lexicalPath };
   }
@@ -25543,9 +25630,8 @@ function formatRoutingReport(report2, options = {}) {
 }
 
 // plugins/kxm/src/vnext-runtime-supervisor.ts
-var repoRoot = resolve7(fileURLToPath2(new URL("../../../", import.meta.url)));
 function vnextSupervisorTokenFile(paths) {
-  return join10(paths.runtimeDir, "supervisor.token");
+  return join12(paths.runtimeDir, "supervisor.token");
 }
 function readVnextSupervisorToken(paths) {
   const file = vnextSupervisorTokenFile(paths);
@@ -25554,7 +25640,7 @@ function readVnextSupervisorToken(paths) {
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw runtimeError("runtime_path_invalid", file, "supervisor token file must be a regular file, not a link");
   }
-  const token = readFileSync10(file, "utf8").trim();
+  const token = readFileSync11(file, "utf8").trim();
   return token.length >= 32 ? token : void 0;
 }
 function processAlive(pid) {
@@ -25568,11 +25654,11 @@ function processAlive(pid) {
 var HEARTBEAT_STALE_MS = 15e3;
 var SUPERVISOR_ERROR_MAX_AGE_MS = 3e4;
 function supervisorErrorFile(paths) {
-  return join10(paths.runtimeDir, "supervisor.error");
+  return join12(paths.runtimeDir, "supervisor.error");
 }
 function clearSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
-  if (existsSync10(file)) rmSync2(file, { force: true });
+  if (existsSync12(file)) rmSync3(file, { force: true });
 }
 function readRecentSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
@@ -25581,13 +25667,13 @@ function readRecentSupervisorError(paths) {
   const ageMs = Date.now() - stat.mtimeMs;
   if (ageMs > SUPERVISOR_ERROR_MAX_AGE_MS) return void 0;
   try {
-    return readFileSync10(file, "utf8").trim();
+    return readFileSync11(file, "utf8").trim();
   } catch {
     return void 0;
   }
 }
 function vnextSupervisorStatus(paths) {
-  if (!existsSync10(paths.registryDb)) return { running: false };
+  if (!existsSync12(paths.registryDb)) return { running: false };
   const registry = new VnextRuntimeRegistry(paths.registryDb);
   try {
     const record = registry.supervisor();
@@ -25648,7 +25734,7 @@ async function ensureVnextSupervisor(options = {}) {
     throw runtimeError("runtime_supervisor_unreachable", paths.registryDb, `runtime supervisor pid ${status.pid} is registered as running but cannot be probed`);
   }
   clearSupervisorError(paths);
-  const scriptPath = join10(repoRoot, "scripts", "kxm-runtime-supervisor.mjs");
+  const scriptPath = join12(findKxmRepoRoot(import.meta.url), "scripts", "kxm-runtime-supervisor.mjs");
   const spawnImpl = options.spawnImpl ?? ((script, env) => {
     const child = spawn2(process.execPath, [script], {
       detached: true,
@@ -25701,8 +25787,7 @@ async function vnextRuntimeRequest(handle, method, path4, body) {
 
 // plugins/kxm/src/cli/types.ts
 import { spawn as spawn3 } from "node:child_process";
-import { join as join13, resolve as resolve9 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { join as join15, resolve as resolve9 } from "node:path";
 
 // plugins/kxm/src/redact.ts
 var SECRET_PATTERNS = [
@@ -25732,8 +25817,8 @@ function redactStringList(values, maxItems = 32) {
 }
 
 // plugins/kxm/src/telemetry.ts
-import { appendFileSync, mkdirSync as mkdirSync8, readFileSync as readFileSync11 } from "node:fs";
-import { dirname as dirname7, join as join11 } from "node:path";
+import { appendFileSync, mkdirSync as mkdirSync9, readFileSync as readFileSync12 } from "node:fs";
+import { dirname as dirname9, join as join13 } from "node:path";
 var TELEMETRY_SCHEMA = "kxm.telemetry.v1";
 function inferImprovementTarget(input) {
   const explicit = input.env?.KXM_IMPROVE_TARGET?.trim();
@@ -25743,12 +25828,12 @@ function inferImprovementTarget(input) {
   return project || workflowId ? "project" : "cli";
 }
 function appendTelemetry(path4, event) {
-  mkdirSync8(dirname7(path4), { recursive: true });
+  mkdirSync9(dirname9(path4), { recursive: true });
   appendFileSync(path4, `${JSON.stringify(event)}
 `, { encoding: "utf8", mode: 384 });
 }
 function telemetryPath(logsDir) {
-  return join11(logsDir, "telemetry.jsonl");
+  return join13(logsDir, "telemetry.jsonl");
 }
 function makeTelemetryEvent(input) {
   return {
@@ -25763,7 +25848,7 @@ function makeTelemetryEvent(input) {
 function readRoutingRecords(path4) {
   const records = [];
   try {
-    const raw = readFileSync11(path4, "utf8");
+    const raw = readFileSync12(path4, "utf8");
     for (const line of raw.split(/\r?\n/)) {
       if (!line.trim()) continue;
       try {
@@ -25840,9 +25925,9 @@ function workerResult(worker, payload) {
 }
 
 // plugins/kxm/src/hub-binding.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync12, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute5, join as join12, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync13, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname10, isAbsolute as isAbsolute6, join as join14, resolve as resolve8 } from "node:path";
 var HUB_BINDING_SCHEMA = "kxm.hub-binding.v1";
 var HUB_HEALTH_PROBE_MS = 300;
 var HubBindingError = class extends Error {
@@ -25851,24 +25936,24 @@ var HubBindingError = class extends Error {
     this.name = "HubBindingError";
   }
 };
-function resolveUserStateRoot(env) {
+function resolveUserStateRoot2(env) {
   const explicit = env.KXM_STATE_HOME?.trim();
   if (explicit) {
-    if (!isAbsolute5(explicit)) throw new HubBindingError("local_state_root_not_absolute");
+    if (!isAbsolute6(explicit)) throw new HubBindingError("local_state_root_not_absolute");
     return resolve8(explicit);
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute5(localAppData) ? localAppData : join12(homedir3(), "AppData", "Local");
+    const base2 = localAppData && isAbsolute6(localAppData) ? localAppData : join14(homedir4(), "AppData", "Local");
     return resolve8(base2, "KXM");
   }
-  if (process.platform === "darwin") return resolve8(homedir3(), "Library", "Application Support", "KXM");
+  if (process.platform === "darwin") return resolve8(homedir4(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute5(xdgState) ? xdgState : join12(homedir3(), ".local", "state");
+  const base = xdgState && isAbsolute6(xdgState) ? xdgState : join14(homedir4(), ".local", "state");
   return resolve8(base, "kxm");
 }
 function hubBindingFile(env = process.env) {
-  return join12(resolveUserStateRoot(env), "hub-binding.json");
+  return join14(resolveUserStateRoot2(env), "hub-binding.json");
 }
 function validateHubUrl(raw) {
   let parsed;
@@ -25893,10 +25978,10 @@ function isAbortError(error) {
 }
 function readHubBinding(env = process.env) {
   const file = hubBindingFile(env);
-  if (!existsSync11(file)) return void 0;
+  if (!existsSync13(file)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(file, "utf8"));
+    parsed = JSON.parse(readFileSync13(file, "utf8"));
   } catch {
     throw new HubBindingError(`malformed hub binding at ${file}`);
   }
@@ -25918,21 +26003,21 @@ function readHubBinding(env = process.env) {
 }
 function writeHubBinding(record, env = process.env) {
   const file = hubBindingFile(env);
-  mkdirSync9(dirname8(file), { recursive: true, mode: 448 });
-  const temporary = join12(dirname8(file), `.hub-binding-${process.pid}.tmp`);
+  mkdirSync10(dirname10(file), { recursive: true, mode: 448 });
+  const temporary = join14(dirname10(file), `.hub-binding-${process.pid}.tmp`);
   try {
-    writeFileSync8(temporary, `${JSON.stringify(record, null, 2)}
+    writeFileSync9(temporary, `${JSON.stringify(record, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-    renameSync3(temporary, file);
+    renameSync4(temporary, file);
   } finally {
-    rmSync3(temporary, { force: true });
+    rmSync4(temporary, { force: true });
   }
   return file;
 }
 function removeHubBinding(env = process.env) {
   const file = hubBindingFile(env);
   try {
-    rmSync3(file);
+    rmSync4(file);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -25964,10 +26049,9 @@ async function probeHubHealth(url, fetchImpl, timeoutMs = HUB_HEALTH_PROBE_MS) {
 }
 
 // plugins/kxm/src/cli/types.ts
-var repoRoot2 = resolve9(fileURLToPath3(new URL("../../../../", import.meta.url)));
 function spawnScript(scriptName, extraEnv = {}) {
   return new Promise((resolveExit) => {
-    const child = spawn3(process.execPath, [join13(repoRoot2, "scripts", scriptName)], {
+    const child = spawn3(process.execPath, [join15(findKxmRepoRoot(import.meta.url), "scripts", scriptName)], {
       stdio: "inherit",
       env: { ...process.env, ...extraEnv }
     });
@@ -26057,10 +26141,10 @@ function workspaceDirs(cwd, workspaceFlag, env) {
   return {
     workdir,
     workspace,
-    config: derive ? join13(workspace, "config") : resolve9(workdir, env.KXM_CONFIG_DIR?.trim() || join13(workspace, "config")),
-    logs: derive ? join13(workspace, "logs") : resolve9(workdir, env.KXM_LOGS_DIR?.trim() || join13(workspace, "logs")),
-    assets: derive ? join13(workspace, "assets") : resolve9(workdir, env.KXM_ASSETS_DIR?.trim() || join13(workspace, "assets")),
-    state: derive ? join13(workspace, "state") : resolve9(workdir, env.KXM_STATE_DIR?.trim() || join13(workspace, "state"))
+    config: derive ? join15(workspace, "config") : resolve9(workdir, env.KXM_CONFIG_DIR?.trim() || join15(workspace, "config")),
+    logs: derive ? join15(workspace, "logs") : resolve9(workdir, env.KXM_LOGS_DIR?.trim() || join15(workspace, "logs")),
+    assets: derive ? join15(workspace, "assets") : resolve9(workdir, env.KXM_ASSETS_DIR?.trim() || join15(workspace, "assets")),
+    state: derive ? join15(workspace, "state") : resolve9(workdir, env.KXM_STATE_DIR?.trim() || join15(workspace, "state"))
   };
 }
 function maskEnvName(name) {
@@ -26128,20 +26212,20 @@ function workspaceEnv(runtime) {
 // plugins/kxm/src/cli/roles.ts
 var import_yaml8 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
-import { join as join16, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { join as join18, resolve as resolve12 } from "node:path";
 import { createInterface } from "node:readline";
 
 // plugins/kxm/src/role.ts
 var import_yaml7 = __toESM(require_dist(), 1);
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, readdirSync as readdirSync4, readFileSync as readFileSync14, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync12, readdirSync as readdirSync4, readFileSync as readFileSync15, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join17 } from "node:path";
 
 // plugins/kxm/src/config.ts
 var import_yaml6 = __toESM(require_dist(), 1);
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname9, join as join14, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname11, join as join16, resolve as resolve10 } from "node:path";
 var KXM_CONFIG_SCHEMA = "kxm.config.v1";
 var DEFAULT_KXM_CONFIG = {
   schema: KXM_CONFIG_SCHEMA,
@@ -26195,10 +26279,10 @@ var DEFAULT_KXM_CONFIG = {
 };
 function userConfigDirectory(overrideDir) {
   if (overrideDir) return resolve10(overrideDir);
-  return resolve10(process.env.KXM_USER_CONFIG_DIR?.trim() || join14(homedir4(), ".config", "kxm"));
+  return resolve10(process.env.KXM_USER_CONFIG_DIR?.trim() || join16(homedir5(), ".config", "kxm"));
 }
-function repoConfigDirectory(repoRoot6) {
-  return resolve10(repoRoot6, ".kxm");
+function repoConfigDirectory(repoRoot) {
+  return resolve10(repoRoot, ".kxm");
 }
 function deepMerge(target, source) {
   const result = { ...target };
@@ -26216,16 +26300,16 @@ function normalizeHubConfig(raw) {
   const autoStart = raw?.autoStart;
   return { autoStart: autoStart === "off" || autoStart === "background" ? autoStart : DEFAULT_KXM_CONFIG.hub.autoStart };
 }
-function loadKxmConfig(repoRoot6 = process.cwd(), options = {}) {
+function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   const userDir = userConfigDirectory(options.userConfigDir);
-  const userConfigFile = join14(userDir, "config.yaml");
-  const repoDir = repoConfigDirectory(repoRoot6);
-  const repoConfigFile = join14(repoDir, "config.yaml");
+  const userConfigFile = join16(userDir, "config.yaml");
+  const repoDir = repoConfigDirectory(repoRoot);
+  const repoConfigFile = join16(repoDir, "config.yaml");
   let userRaw = {};
   let userLoadedPath;
-  if (existsSync12(userConfigFile)) {
+  if (existsSync14(userConfigFile)) {
     try {
-      const text = readFileSync13(userConfigFile, "utf8");
+      const text = readFileSync14(userConfigFile, "utf8");
       userRaw = (0, import_yaml6.parse)(text) ?? {};
       userLoadedPath = userConfigFile;
     } catch (error) {
@@ -26234,9 +26318,9 @@ function loadKxmConfig(repoRoot6 = process.cwd(), options = {}) {
   }
   let repoRaw = {};
   let repoLoadedPath;
-  if (existsSync12(repoConfigFile)) {
+  if (existsSync14(repoConfigFile)) {
     try {
-      const text = readFileSync13(repoConfigFile, "utf8");
+      const text = readFileSync14(repoConfigFile, "utf8");
       repoRaw = (0, import_yaml6.parse)(text) ?? {};
       repoLoadedPath = repoConfigFile;
     } catch (error) {
@@ -26271,14 +26355,14 @@ function getKxmConfigValue(config, keyPath) {
   }
   return current;
 }
-function setKxmConfigValue(repoRoot6, keyPath, value, options = {}) {
+function setKxmConfigValue(repoRoot, keyPath, value, options = {}) {
   const scope = options.scope ?? "project";
-  const targetFile2 = scope === "user" ? join14(userConfigDirectory(options.userConfigDir), "config.yaml") : join14(repoConfigDirectory(repoRoot6), "config.yaml");
-  mkdirSync10(dirname9(targetFile2), { recursive: true });
+  const targetFile2 = scope === "user" ? join16(userConfigDirectory(options.userConfigDir), "config.yaml") : join16(repoConfigDirectory(repoRoot), "config.yaml");
+  mkdirSync11(dirname11(targetFile2), { recursive: true });
   let existing = {};
-  if (existsSync12(targetFile2)) {
+  if (existsSync14(targetFile2)) {
     try {
-      existing = (0, import_yaml6.parse)(readFileSync13(targetFile2, "utf8")) ?? {};
+      existing = (0, import_yaml6.parse)(readFileSync14(targetFile2, "utf8")) ?? {};
     } catch {
       existing = {};
     }
@@ -26296,7 +26380,7 @@ function setKxmConfigValue(repoRoot6, keyPath, value, options = {}) {
     cursor2 = cursor2[p];
   }
   cursor2[parts[parts.length - 1]] = value;
-  writeFileSync9(targetFile2, (0, import_yaml6.stringify)(existing).trim() + "\n", "utf8");
+  writeFileSync10(targetFile2, (0, import_yaml6.stringify)(existing).trim() + "\n", "utf8");
 }
 function formatKxmConfig(config) {
   const display = {
@@ -26387,23 +26471,23 @@ var DEFAULT_ROLES = {
     ]
   }
 };
-function rolesDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
+function rolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join15(userConfigDirectory(userConfigDir), "roles");
+    return join17(userConfigDirectory(userConfigDir), "roles");
   }
-  return join15(repoConfigDirectory(repoRoot6), "roles");
+  return join17(repoConfigDirectory(repoRoot), "roles");
 }
-function ensureRolesDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
-  const dir = rolesDirectory(scope, repoRoot6, userConfigDir);
-  if (!existsSync13(dir)) {
-    mkdirSync11(dir, { recursive: true });
+function ensureRolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
+  const dir = rolesDirectory(scope, repoRoot, userConfigDir);
+  if (!existsSync15(dir)) {
+    mkdirSync12(dir, { recursive: true });
   }
   return dir;
 }
 function parseRoleFile(filePath) {
-  if (!existsSync13(filePath)) return void 0;
+  if (!existsSync15(filePath)) return void 0;
   try {
-    const raw = readFileSync14(filePath, "utf8");
+    const raw = readFileSync15(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
     if (!parsed || typeof parsed !== "object" || parsed.schema !== KXM_ROLE_SCHEMA) {
       return void 0;
@@ -26426,14 +26510,14 @@ function parseRoleFile(filePath) {
 }
 function listRoles(options = {}) {
   const scopeFilter = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const globalDir = rolesDirectory("global", repoRoot6, options.userConfigDir);
-  const localDir = rolesDirectory("local", repoRoot6, options.userConfigDir);
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const globalDir = rolesDirectory("global", repoRoot, options.userConfigDir);
+  const localDir = rolesDirectory("local", repoRoot, options.userConfigDir);
   const localRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync13(localDir)) {
+  if (scopeFilter !== "global" && existsSync15(localDir)) {
     for (const entry of readdirSync4(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join15(localDir, entry);
+        const filePath = join17(localDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           localRoles.set(parsed.id, { role: parsed, filePath });
@@ -26442,10 +26526,10 @@ function listRoles(options = {}) {
     }
   }
   const globalRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync13(globalDir)) {
+  if (scopeFilter !== "local" && existsSync15(globalDir)) {
     for (const entry of readdirSync4(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join15(globalDir, entry);
+        const filePath = join17(globalDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           globalRoles.set(parsed.id, { role: parsed, filePath });
@@ -26490,16 +26574,16 @@ function listRoles(options = {}) {
 }
 function getRole(roleId, options = {}) {
   const scope = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
+  const repoRoot = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
-    const localDir = rolesDirectory("local", repoRoot6, options.userConfigDir);
-    const localFile = join15(localDir, `${roleId}.yaml`);
+    const localDir = rolesDirectory("local", repoRoot, options.userConfigDir);
+    const localFile = join17(localDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(localFile);
     if (parsed) return { role: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
-    const globalDir = rolesDirectory("global", repoRoot6, options.userConfigDir);
-    const globalFile = join15(globalDir, `${roleId}.yaml`);
+    const globalDir = rolesDirectory("global", repoRoot, options.userConfigDir);
+    const globalFile = join17(globalDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(globalFile);
     if (parsed) return { role: parsed, scope: "global", filePath: globalFile };
   }
@@ -26507,24 +26591,24 @@ function getRole(roleId, options = {}) {
 }
 function addRole(role, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = ensureRolesDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join15(dir, `${role.id}.yaml`);
-  if (existsSync13(filePath) && !options.overwrite) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join17(dir, `${role.id}.yaml`);
+  if (existsSync15(filePath) && !options.overwrite) {
     throw new Error(`role_already_exists: role '${role.id}' already exists at ${filePath}`);
   }
-  writeFileSync10(filePath, (0, import_yaml7.stringify)(role), "utf8");
+  writeFileSync11(filePath, (0, import_yaml7.stringify)(role), "utf8");
   return { id: role.id, filePath, scope };
 }
 function removeRole(roleId, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = rolesDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join15(dir, `${roleId}.yaml`);
-  if (!existsSync13(filePath)) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = rolesDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join17(dir, `${roleId}.yaml`);
+  if (!existsSync15(filePath)) {
     throw new Error(`role_not_found: role '${roleId}' not found in ${scope} directory (${filePath})`);
   }
-  rmSync4(filePath);
+  rmSync5(filePath);
   return { id: roleId, removed: true, filePath, scope };
 }
 function modifyRole(roleId, updates, options = {}) {
@@ -26540,10 +26624,10 @@ function modifyRole(roleId, updates, options = {}) {
     // preserve identity
   };
   const scope = options.scope ?? target.scope;
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = ensureRolesDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join15(dir, `${roleId}.yaml`);
-  writeFileSync10(filePath, (0, import_yaml7.stringify)(updated), "utf8");
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join17(dir, `${roleId}.yaml`);
+  writeFileSync11(filePath, (0, import_yaml7.stringify)(updated), "utf8");
   return { id: roleId, role: updated, filePath, scope };
 }
 var KXM_ROLE_HOSTS_SCHEMA = "kxm.role-hosts.v1";
@@ -26589,20 +26673,20 @@ var DEFAULT_ROLE_SEATS = {
     requiredEvidenceKind: "test_run"
   }
 };
-function findExistingRoleHostsFile(scope, repoRoot6 = process.cwd(), userConfigDir) {
-  const dir = scope === "global" ? userConfigDirectory(userConfigDir) : repoConfigDirectory(repoRoot6);
-  const yamlPath = join15(dir, "role-hosts.yaml");
-  const ymlPath = join15(dir, "role-hosts.yml");
-  const jsonPath = join15(dir, "role-hosts.json");
-  if (existsSync13(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
-  if (existsSync13(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
-  if (existsSync13(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
+function findExistingRoleHostsFile(scope, repoRoot = process.cwd(), userConfigDir) {
+  const dir = scope === "global" ? userConfigDirectory(userConfigDir) : repoConfigDirectory(repoRoot);
+  const yamlPath = join17(dir, "role-hosts.yaml");
+  const ymlPath = join17(dir, "role-hosts.yml");
+  const jsonPath = join17(dir, "role-hosts.json");
+  if (existsSync15(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
+  if (existsSync15(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
+  if (existsSync15(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
   return { filePath: yamlPath, exists: false, format: "yaml" };
 }
 function parseRoleHostsFile(filePath) {
-  if (!existsSync13(filePath)) return void 0;
+  if (!existsSync15(filePath)) return void 0;
   try {
-    const raw = readFileSync14(filePath, "utf8");
+    const raw = readFileSync15(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
     if (!parsed || typeof parsed !== "object") return void 0;
     if (parsed.schema && parsed.schema !== KXM_ROLE_HOSTS_SCHEMA) return void 0;
@@ -26617,11 +26701,11 @@ function parseRoleHostsFile(filePath) {
 }
 function loadRoleHostsConfig(options = {}) {
   const scopeFilter = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
+  const repoRoot = options.repoRoot ?? process.cwd();
   let localConfig;
   let localPath;
   if (scopeFilter !== "global") {
-    const localFound = findExistingRoleHostsFile("local", repoRoot6, options.userConfigDir);
+    const localFound = findExistingRoleHostsFile("local", repoRoot, options.userConfigDir);
     if (localFound.exists) {
       localConfig = parseRoleHostsFile(localFound.filePath);
       localPath = localFound.filePath;
@@ -26630,7 +26714,7 @@ function loadRoleHostsConfig(options = {}) {
   let globalConfig;
   let globalPath;
   if (scopeFilter !== "local") {
-    const globalFound = findExistingRoleHostsFile("global", repoRoot6, options.userConfigDir);
+    const globalFound = findExistingRoleHostsFile("global", repoRoot, options.userConfigDir);
     if (globalFound.exists) {
       globalConfig = parseRoleHostsFile(globalFound.filePath);
       globalPath = globalFound.filePath;
@@ -26672,20 +26756,20 @@ function loadRoleHostsConfig(options = {}) {
 }
 function saveRoleHostsConfig(config, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = scope === "global" ? userConfigDirectory(options.userConfigDir) : repoConfigDirectory(repoRoot6);
-  if (!existsSync13(dir)) {
-    mkdirSync11(dir, { recursive: true });
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = scope === "global" ? userConfigDirectory(options.userConfigDir) : repoConfigDirectory(repoRoot);
+  if (!existsSync15(dir)) {
+    mkdirSync12(dir, { recursive: true });
   }
   const format = options.format ?? "yaml";
-  const filePath = join15(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
+  const filePath = join17(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
   const payload = {
     schema: KXM_ROLE_HOSTS_SCHEMA,
     seats: config.seats ?? {},
     ...config.hostProviders && Object.keys(config.hostProviders).length > 0 ? { hostProviders: config.hostProviders } : {}
   };
   const content = format === "json" ? JSON.stringify(payload, null, 2) + "\n" : (0, import_yaml7.stringify)(payload);
-  writeFileSync10(filePath, content, "utf8");
+  writeFileSync11(filePath, content, "utf8");
   return { filePath, scope };
 }
 function setRoleSeatHost(seatId, host, options = {}) {
@@ -26920,7 +27004,7 @@ async function cmdRoleAdd(runtime, roleId, options) {
   let roleDef;
   if (options.file) {
     const filePath = resolve12(runtime.cwd, options.file);
-    const content = readFileSync15(filePath, "utf8");
+    const content = readFileSync16(filePath, "utf8");
     roleDef = (0, import_yaml8.parse)(content);
     roleDef.id = roleId;
   } else {
@@ -27219,8 +27303,8 @@ async function cmdRoleResume(runtime, runId, ruling) {
       return 1;
     }
   }
-  const dbPath = join16(runtime.cwd, ".kxm", "state", "kxm.db");
-  if (existsSync14(dbPath)) {
+  const dbPath = join18(runtime.cwd, ".kxm", "state", "kxm.db");
+  if (existsSync16(dbPath)) {
     try {
       const database = new DatabaseSync(dbPath);
       try {
@@ -27282,11 +27366,11 @@ async function cmdRoleResume(runtime, runId, ruling) {
 
 // plugins/kxm/src/cli/workflows.ts
 import { createHmac as createHmac3, randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync16, readFileSync as readFileSync17 } from "node:fs";
-import { join as join18, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
+import { join as join20, resolve as resolve15 } from "node:path";
 
 // plugins/kxm/src/retrospective.ts
-import { mkdirSync as mkdirSync12, renameSync as renameSync4, writeFileSync as writeFileSync11 } from "node:fs";
+import { mkdirSync as mkdirSync13, renameSync as renameSync5, writeFileSync as writeFileSync12 } from "node:fs";
 import { resolve as resolve13 } from "node:path";
 var MAX_RETROSPECTIVE_ENTRIES = 500;
 var SAFE_RUN_ID = /^run_[A-Za-z0-9_-]{1,120}$/;
@@ -27499,7 +27583,7 @@ function renderRetrospectiveMarkdown(doc) {
 }
 function writeRetrospective(outDir, doc) {
   if (!SAFE_RUN_ID.test(doc.runId)) throw new Error("invalid retrospective run id");
-  mkdirSync12(outDir, { recursive: true });
+  mkdirSync13(outDir, { recursive: true });
   const root = resolve13(outDir);
   const jsonPath = resolve13(root, `${doc.runId}.json`);
   const mdPath = resolve13(root, `${doc.runId}.md`);
@@ -27507,11 +27591,11 @@ function writeRetrospective(outDir, doc) {
   if (!jsonPath.startsWith(prefix) || !mdPath.startsWith(prefix)) throw new Error("retrospective path escaped output directory");
   const jsonTmp = `${jsonPath}.tmp`;
   const mdTmp = `${mdPath}.tmp`;
-  writeFileSync11(jsonTmp, `${JSON.stringify(doc, null, 2)}
+  writeFileSync12(jsonTmp, `${JSON.stringify(doc, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-  writeFileSync11(mdTmp, renderRetrospectiveMarkdown(doc), { encoding: "utf8", mode: 384 });
-  renameSync4(jsonTmp, jsonPath);
-  renameSync4(mdTmp, mdPath);
+  writeFileSync12(mdTmp, renderRetrospectiveMarkdown(doc), { encoding: "utf8", mode: 384 });
+  renameSync5(jsonTmp, jsonPath);
+  renameSync5(mdTmp, mdPath);
   return { jsonPath, mdPath };
 }
 
@@ -27701,8 +27785,8 @@ async function watchGithubChecks(input) {
 
 // plugins/kxm/src/workflow-manager.ts
 var import_yaml9 = __toESM(require_dist(), 1);
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readdirSync as readdirSync5, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync14, readdirSync as readdirSync5, readFileSync as readFileSync17, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join19 } from "node:path";
 var WORKFLOW_TEMPLATES = {
   "implement-and-verify": {
     schema: "kxm.workflow.v1",
@@ -27851,23 +27935,23 @@ var WORKFLOW_TEMPLATES = {
   }
 };
 var DEFAULT_WORKFLOW_TEMPLATE = WORKFLOW_TEMPLATES["implement-and-verify"];
-function workflowsDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
+function workflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join17(userConfigDirectory(userConfigDir), "workflows");
+    return join19(userConfigDirectory(userConfigDir), "workflows");
   }
-  return join17(repoConfigDirectory(repoRoot6), "workflows");
+  return join19(repoConfigDirectory(repoRoot), "workflows");
 }
-function ensureWorkflowsDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
-  const dir = workflowsDirectory(scope, repoRoot6, userConfigDir);
-  if (!existsSync15(dir)) {
-    mkdirSync13(dir, { recursive: true });
+function ensureWorkflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
+  const dir = workflowsDirectory(scope, repoRoot, userConfigDir);
+  if (!existsSync17(dir)) {
+    mkdirSync14(dir, { recursive: true });
   }
   return dir;
 }
 function parseWorkflowFile(filePath) {
-  if (!existsSync15(filePath)) return void 0;
+  if (!existsSync17(filePath)) return void 0;
   try {
-    const raw = readFileSync16(filePath, "utf8");
+    const raw = readFileSync17(filePath, "utf8");
     const parsed = (0, import_yaml9.parse)(raw);
     if (!parsed || typeof parsed !== "object") return void 0;
     return parsed;
@@ -27877,14 +27961,14 @@ function parseWorkflowFile(filePath) {
 }
 function listWorkflowDefinitions(options = {}) {
   const scopeFilter = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const globalDir = workflowsDirectory("global", repoRoot6, options.userConfigDir);
-  const localDir = workflowsDirectory("local", repoRoot6, options.userConfigDir);
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const globalDir = workflowsDirectory("global", repoRoot, options.userConfigDir);
+  const localDir = workflowsDirectory("local", repoRoot, options.userConfigDir);
   const localDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync15(localDir)) {
+  if (scopeFilter !== "global" && existsSync17(localDir)) {
     for (const entry of readdirSync5(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join17(localDir, entry);
+        const filePath = join19(localDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
           const id = def.id || entry.replace(/\.ya?ml$/i, "");
@@ -27894,10 +27978,10 @@ function listWorkflowDefinitions(options = {}) {
     }
   }
   const globalDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync15(globalDir)) {
+  if (scopeFilter !== "local" && existsSync17(globalDir)) {
     for (const entry of readdirSync5(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join17(globalDir, entry);
+        const filePath = join19(globalDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
           const id = def.id || entry.replace(/\.ya?ml$/i, "");
@@ -27950,16 +28034,16 @@ function listWorkflowDefinitions(options = {}) {
 }
 function getWorkflowDefinition(workflowId, options = {}) {
   const scope = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
+  const repoRoot = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
-    const localDir = workflowsDirectory("local", repoRoot6, options.userConfigDir);
-    const localFile = join17(localDir, `${workflowId}.yaml`);
+    const localDir = workflowsDirectory("local", repoRoot, options.userConfigDir);
+    const localFile = join19(localDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(localFile);
     if (parsed) return { workflow: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
-    const globalDir = workflowsDirectory("global", repoRoot6, options.userConfigDir);
-    const globalFile = join17(globalDir, `${workflowId}.yaml`);
+    const globalDir = workflowsDirectory("global", repoRoot, options.userConfigDir);
+    const globalFile = join19(globalDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(globalFile);
     if (parsed) return { workflow: parsed, scope: "global", filePath: globalFile };
   }
@@ -27967,25 +28051,25 @@ function getWorkflowDefinition(workflowId, options = {}) {
 }
 function addWorkflowDefinition(workflowId, content = DEFAULT_WORKFLOW_TEMPLATE, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = ensureWorkflowsDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join17(dir, `${workflowId}.yaml`);
-  if (existsSync15(filePath) && !options.overwrite) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join19(dir, `${workflowId}.yaml`);
+  if (existsSync17(filePath) && !options.overwrite) {
     throw new Error(`workflow_already_exists: workflow '${workflowId}' already exists at ${filePath}`);
   }
   const payload = typeof content === "string" ? content : (0, import_yaml9.stringify)(content);
-  writeFileSync12(filePath, payload, "utf8");
+  writeFileSync13(filePath, payload, "utf8");
   return { id: workflowId, filePath, scope };
 }
 function removeWorkflowDefinition(workflowId, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = workflowsDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join17(dir, `${workflowId}.yaml`);
-  if (!existsSync15(filePath)) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = workflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join19(dir, `${workflowId}.yaml`);
+  if (!existsSync17(filePath)) {
     throw new Error(`workflow_not_found: workflow '${workflowId}' not found in ${scope} directory (${filePath})`);
   }
-  rmSync5(filePath);
+  rmSync6(filePath);
   return { id: workflowId, removed: true, filePath, scope };
 }
 function modifyWorkflowDefinition(workflowId, updates, options = {}) {
@@ -27998,17 +28082,17 @@ function modifyWorkflowDefinition(workflowId, updates, options = {}) {
     ...updates
   };
   const scope = options.scope ?? target.scope;
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = ensureWorkflowsDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join17(dir, `${workflowId}.yaml`);
-  writeFileSync12(filePath, (0, import_yaml9.stringify)(updated), "utf8");
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join19(dir, `${workflowId}.yaml`);
+  writeFileSync13(filePath, (0, import_yaml9.stringify)(updated), "utf8");
   return { id: workflowId, workflow: updated, filePath, scope };
 }
 
 // plugins/kxm/src/cli/workflows.ts
 var CLI_NAME = "kxm";
 function localWorkflowSnapshot(dataPath, runId) {
-  if (!existsSync16(dataPath)) throw new Error("state_database_not_found");
+  if (!existsSync18(dataPath)) throw new Error("state_database_not_found");
   const database = new DatabaseSync(dataPath, { readOnly: true });
   try {
     const rows = runId ? database.prepare("SELECT record FROM workflow_runs WHERE id = ?").all(runId) : database.prepare("SELECT record FROM workflow_runs ORDER BY rowid DESC LIMIT 200").all();
@@ -28085,7 +28169,7 @@ function activeWorkflowDefinition(runtime, definitionId) {
   let raw;
   if (file) {
     try {
-      raw = readFileSync17(resolve15(runtime.cwd, file), "utf8");
+      raw = readFileSync18(resolve15(runtime.cwd, file), "utf8");
     } catch {
       throw new Error("workflow definition file is unavailable");
     }
@@ -28167,7 +28251,7 @@ async function cmdWorkflowAdd(runtime, workflowId, options) {
   }
   if (options.file) {
     const filePath = resolve15(runtime.cwd, options.file);
-    content = readFileSync17(filePath, "utf8");
+    content = readFileSync18(filePath, "utf8");
   } else if (!content) {
     content = {
       schema: "kxm.workflow.v1",
@@ -28325,7 +28409,7 @@ async function cmdWorkflowStart(runtime, definitionIdArg, options) {
   }
   let payload;
   try {
-    const raw = payloadFlag.startsWith("@") ? readFileSync17(resolve15(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
+    const raw = payloadFlag.startsWith("@") ? readFileSync18(resolve15(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
     const value = JSON.parse(raw);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("object required");
     payload = value;
@@ -28392,7 +28476,7 @@ async function cmdWorkflowDegrade(runtime, runId, stageId, options) {
   }
 }
 async function cmdWorkflowInspect(runtime, action, runId) {
-  const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join18(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join20(runtime.dirs.state, "kxm.db"));
   if (action === "get" && !runId) {
     runtime.io.stderr(`Usage: ${CLI_NAME} workflow get <runId>
 `);
@@ -28565,10 +28649,10 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
   let snapshot;
   try {
     if (snapshotPath) {
-      if (!existsSync16(snapshotPath)) throw new Error("snapshot_missing");
-      snapshot = JSON.parse(readFileSync17(snapshotPath, "utf8"));
+      if (!existsSync18(snapshotPath)) throw new Error("snapshot_missing");
+      snapshot = JSON.parse(readFileSync18(snapshotPath, "utf8"));
     } else {
-      const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join18(runtime.dirs.state, "kxm.db"));
+      const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join20(runtime.dirs.state, "kxm.db"));
       const local = localWorkflowSnapshot(dataPath, runId);
       if (!local.runs[0]) throw new Error("workflow_not_found");
       snapshot = { run: local.runs[0], journal: local.journal };
@@ -28580,7 +28664,7 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 1;
   }
   const doc = buildRetrospective(snapshot.run, snapshot.journal);
-  const outDir = resolve15(runtime.cwd, String(options.outDir || join18(runtime.dirs.assets, "retrospectives")));
+  const outDir = resolve15(runtime.cwd, String(options.outDir || join20(runtime.dirs.assets, "retrospectives")));
   const assetsRoot = resolve15(runtime.dirs.assets);
   const assetsPrefix = `${assetsRoot}${process.platform === "win32" ? "\\" : "/"}`;
   if (outDir !== assetsRoot && !outDir.startsWith(assetsPrefix)) {
@@ -28598,8 +28682,8 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
 
 // plugins/kxm/src/cli/tasks.ts
 var import_yaml13 = __toESM(require_dist(), 1);
-import { existsSync as existsSync22, readFileSync as readFileSync22, readdirSync as readdirSync8 } from "node:fs";
-import { basename as basename6, join as join26, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync23, readdirSync as readdirSync8 } from "node:fs";
+import { basename as basename6, join as join28, resolve as resolve21 } from "node:path";
 
 // plugins/kxm/src/suggest.ts
 var WORKFLOW_PATTERNS = [
@@ -28710,19 +28794,19 @@ function suggestWorkflowAndRoles(prompt, options = {}) {
 // plugins/kxm/src/task-manager.ts
 var import_yaml10 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync14, readFileSync as readFileSync18, readdirSync as readdirSync6, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join19, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync15, readFileSync as readFileSync19, readdirSync as readdirSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join21, resolve as resolve16 } from "node:path";
 var GOAL_SCHEMA = "kxm.goal.v1";
 var TASK_SCHEMA = "kxm.task.v1";
-function goalsDirectory(repoRoot6) {
-  return resolve16(repoRoot6, ".kxm", "goals");
+function goalsDirectory(repoRoot) {
+  return resolve16(repoRoot, ".kxm", "goals");
 }
-function tasksDirectory(repoRoot6) {
-  return resolve16(repoRoot6, ".kxm", "tasks");
+function tasksDirectory(repoRoot) {
+  return resolve16(repoRoot, ".kxm", "tasks");
 }
-function createGoal(repoRoot6, input) {
-  const dir = goalsDirectory(repoRoot6);
-  mkdirSync14(dir, { recursive: true });
+function createGoal(repoRoot, input) {
+  const dir = goalsDirectory(repoRoot);
+  mkdirSync15(dir, { recursive: true });
   const id = `goal_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record = {
@@ -28736,19 +28820,19 @@ function createGoal(repoRoot6, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join19(dir, `${id}.yaml`);
-  writeFileSync13(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
+  const filePath = join21(dir, `${id}.yaml`);
+  writeFileSync14(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
-function listGoals(repoRoot6) {
-  const dir = goalsDirectory(repoRoot6);
-  if (!existsSync17(dir)) return [];
+function listGoals(repoRoot) {
+  const dir = goalsDirectory(repoRoot);
+  if (!existsSync19(dir)) return [];
   const goals = [];
   const entries = readdirSync6(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync18(join19(dir, entry.name), "utf8");
+        const text = readFileSync19(join21(dir, entry.name), "utf8");
         const doc = (0, import_yaml10.parse)(text);
         if (doc && doc.schema === GOAL_SCHEMA) goals.push(doc);
       } catch {
@@ -28757,9 +28841,9 @@ function listGoals(repoRoot6) {
   }
   return goals.sort((a, b2) => a.createdAt.localeCompare(b2.createdAt));
 }
-function createTask(repoRoot6, input) {
-  const dir = tasksDirectory(repoRoot6);
-  mkdirSync14(dir, { recursive: true });
+function createTask(repoRoot, input) {
+  const dir = tasksDirectory(repoRoot);
+  mkdirSync15(dir, { recursive: true });
   const id = `task_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record = {
@@ -28781,19 +28865,19 @@ function createTask(repoRoot6, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join19(dir, `${id}.yaml`);
-  writeFileSync13(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
+  const filePath = join21(dir, `${id}.yaml`);
+  writeFileSync14(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
-function listTasks(repoRoot6, options = {}) {
-  const dir = tasksDirectory(repoRoot6);
-  if (!existsSync17(dir)) return [];
+function listTasks(repoRoot, options = {}) {
+  const dir = tasksDirectory(repoRoot);
+  if (!existsSync19(dir)) return [];
   const tasks = [];
   const entries = readdirSync6(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync18(join19(dir, entry.name), "utf8");
+        const text = readFileSync19(join21(dir, entry.name), "utf8");
         const doc = (0, import_yaml10.parse)(text);
         if (doc && doc.schema === TASK_SCHEMA) {
           if (options.goalId && doc.goalId !== options.goalId) continue;
@@ -28806,32 +28890,32 @@ function listTasks(repoRoot6, options = {}) {
   }
   return tasks.sort((a, b2) => a.createdAt.localeCompare(b2.createdAt));
 }
-function getTask(repoRoot6, taskId) {
-  const dir = tasksDirectory(repoRoot6);
-  const filePath = join19(dir, `${taskId}.yaml`);
-  if (!existsSync17(filePath)) return void 0;
+function getTask(repoRoot, taskId) {
+  const dir = tasksDirectory(repoRoot);
+  const filePath = join21(dir, `${taskId}.yaml`);
+  if (!existsSync19(filePath)) return void 0;
   try {
-    const text = readFileSync18(filePath, "utf8");
+    const text = readFileSync19(filePath, "utf8");
     const doc = (0, import_yaml10.parse)(text);
     return doc && doc.schema === TASK_SCHEMA ? doc : void 0;
   } catch {
     return void 0;
   }
 }
-function updateTaskStatus(repoRoot6, taskId, status, options = {}) {
-  const task = getTask(repoRoot6, taskId);
+function updateTaskStatus(repoRoot, taskId, status, options = {}) {
+  const task = getTask(repoRoot, taskId);
   if (!task) {
     throw new Error(`Task ${taskId} not found`);
   }
   task.status = status;
   if (options.workflowRunId) task.workflowRunId = options.workflowRunId;
   task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const filePath = join19(tasksDirectory(repoRoot6), `${taskId}.yaml`);
-  writeFileSync13(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
+  const filePath = join21(tasksDirectory(repoRoot), `${taskId}.yaml`);
+  writeFileSync14(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
-function syncTaskWithTracker(repoRoot6, taskId, options = {}) {
-  const task = getTask(repoRoot6, taskId);
+function syncTaskWithTracker(repoRoot, taskId, options = {}) {
+  const task = getTask(repoRoot, taskId);
   if (!task) {
     throw new Error(`Task ${taskId} not found`);
   }
@@ -28842,8 +28926,8 @@ function syncTaskWithTracker(repoRoot6, taskId, options = {}) {
   task.trackerSync.syncStatus = "synced";
   task.trackerSync.lastSyncedAt = now;
   task.updatedAt = now;
-  const filePath = join19(tasksDirectory(repoRoot6), `${taskId}.yaml`);
-  writeFileSync13(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
+  const filePath = join21(tasksDirectory(repoRoot), `${taskId}.yaml`);
+  writeFileSync14(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
 
@@ -29609,14 +29693,13 @@ function createStudioServer(options = {}) {
 }
 
 // plugins/kxm/src/cli/vnext.ts
-import { join as join25, resolve as resolve20 } from "node:path";
+import { join as join27, resolve as resolve20 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // plugins/kxm/src/model-inventory.ts
 var import_yaml11 = __toESM(require_dist(), 1);
-import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join20 } from "node:path";
+import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync15 } from "node:fs";
+import { join as join22 } from "node:path";
 var OR_URL = "https://openrouter.ai/api/v1/models";
 var NOUS_URL = "https://inference-api.nousresearch.com/v1/models";
 function price(value) {
@@ -29702,41 +29785,41 @@ async function refreshModelInventory(options) {
   sources.nous = { url: nousUrl, ok: !nous.error, ...nous.error ? { error: nous.error } : {} };
   for (const item of nous.data) add(item, "nous", "discount");
   const inventory = { schema: "kxm.model-inventory.v1", fetchedAt, currency: "USD", sources, models: [...byId.values()].sort((a, b2) => a.id.localeCompare(b2.id)) };
-  mkdirSync15(join20(options.outputRoot, ".kxm", "models"), { recursive: true });
-  writeFileSync14(join20(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml11.stringify)(inventory), "utf8");
+  mkdirSync16(join22(options.outputRoot, ".kxm", "models"), { recursive: true });
+  writeFileSync15(join22(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml11.stringify)(inventory), "utf8");
   return inventory;
 }
 
 // plugins/kxm/src/vnext-init.ts
 import { randomUUID as randomUUID11 } from "node:crypto";
-import { existsSync as existsSync20 } from "node:fs";
-import { basename as basename5, join as join23 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { basename as basename5, join as join25 } from "node:path";
 
 // plugins/kxm/src/vnext-repair.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
   closeSync as closeSync2,
-  existsSync as existsSync19,
+  existsSync as existsSync21,
   fsyncSync as fsyncSync2,
   linkSync,
   lstatSync as lstatSync7,
-  mkdirSync as mkdirSync17,
+  mkdirSync as mkdirSync18,
   openSync as openSync2,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readdirSync as readdirSync7,
-  renameSync as renameSync5,
-  rmSync as rmSync7,
-  writeFileSync as writeFileSync16
+  renameSync as renameSync6,
+  rmSync as rmSync8,
+  writeFileSync as writeFileSync17
 } from "node:fs";
-import { dirname as dirname13, isAbsolute as isAbsolute6, join as join22, relative as relative4, resolve as resolve18 } from "node:path";
+import { dirname as dirname15, isAbsolute as isAbsolute7, join as join24, relative as relative4, resolve as resolve18 } from "node:path";
 
 // plugins/kxm/src/vnext-permission.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync18, mkdtempSync, mkdirSync as mkdirSync16, readFileSync as readFileSync19, rmSync as rmSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync20, mkdtempSync, mkdirSync as mkdirSync17, readFileSync as readFileSync20, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname12, join as join21, resolve as resolve17, sep as sep3 } from "node:path";
+import { dirname as dirname14, join as join23, resolve as resolve17, sep as sep3 } from "node:path";
 var PROSE_FIELDS = {
   project: /* @__PURE__ */ new Set(["name", "description"]),
   repository: /* @__PURE__ */ new Set(["description"]),
@@ -30257,7 +30340,7 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
   const tree = resolveTreeRevision(root, revision);
   const listing = gitBuffer(root, ["ls-tree", "-r", "-z", "--name-only", tree]).toString("utf8");
   const paths = listing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-  const shadow = mkdtempSync(join21(tmpdir(), "kxm-permission-base-"));
+  const shadow = mkdtempSync(join23(tmpdir(), "kxm-permission-base-"));
   const shadowResolved = resolve17(shadow);
   const shadowMembersDir = `.kxm-shadow-members-${createHash12("sha256").update(shadowResolved, "utf8").digest("hex").slice(0, 8)}`;
   try {
@@ -30271,7 +30354,7 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
           message: "Git tree entry contains a traversal or non-portable segment"
         }]);
       }
-      const absolute = join21(shadowResolved, ...segments);
+      const absolute = join23(shadowResolved, ...segments);
       const resolved = resolve17(absolute);
       if (!resolved.startsWith(`${shadowResolved}${sep3}`)) {
         throw new VnextConfigError([{
@@ -30282,11 +30365,11 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
         }]);
       }
       const content = gitBuffer(root, ["cat-file", "blob", `${tree}:${path4}`]);
-      mkdirSync16(dirname12(absolute), { recursive: true });
-      writeFileSync15(absolute, content);
+      mkdirSync17(dirname14(absolute), { recursive: true });
+      writeFileSync16(absolute, content);
     }
     initShadowGitRoot(shadowResolved);
-    const baseProjectFile = join21(shadowResolved, ".kxm", "project.yaml");
+    const baseProjectFile = join23(shadowResolved, ".kxm", "project.yaml");
     let baseProject;
     try {
       baseProject = loadBaseProjectDeclarations(baseProjectFile);
@@ -30317,7 +30400,7 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
       }
       const boundPath = options.repositoryBindings?.[member.repositoryId];
       const memberWorktree = boundPath ? resolve17(boundPath) : member.pathHint ? resolve17(root, ...member.pathHint.split("/")) : void 0;
-      if (!memberWorktree || !existsSync18(memberWorktree)) {
+      if (!memberWorktree || !existsSync20(memberWorktree)) {
         if (member.required === false) continue;
         throw new VnextConfigError([{
           phase: "discovery",
@@ -30364,7 +30447,7 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
       const memberTree = git(memberWorktree, ["rev-parse", "--verify", "--quiet", `${pinnedCommit}^{tree}`]).trim();
       const memberListing = gitBuffer(memberWorktree, ["ls-tree", "-r", "-z", "--name-only", memberTree]).toString("utf8");
       const memberPaths = memberListing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-      const memberShadowRoot = join21(shadowResolved, shadowMembersDir, member.repositoryId);
+      const memberShadowRoot = join23(shadowResolved, shadowMembersDir, member.repositoryId);
       if (!resolve17(memberShadowRoot).startsWith(`${resolve17(shadowResolved, shadowMembersDir)}${sep3}`)) {
         throw new VnextConfigError([{
           phase: "path",
@@ -30378,14 +30461,14 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
         if (segments.some((segment) => segment === "" || segment === "." || segment === ".." || /[\\:]/.test(segment))) {
           throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry contains a traversal or non-portable segment" }]);
         }
-        const absolute = join21(memberShadowRoot, ...segments);
+        const absolute = join23(memberShadowRoot, ...segments);
         const resolved = resolve17(absolute);
         if (!resolved.startsWith(`${resolve17(memberShadowRoot)}${sep3}`)) {
           throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry escapes the shadow root" }]);
         }
         const content = gitBuffer(memberWorktree, ["cat-file", "blob", `${memberTree}:${path4}`]);
-        mkdirSync16(dirname12(absolute), { recursive: true });
-        writeFileSync15(absolute, content);
+        mkdirSync17(dirname14(absolute), { recursive: true });
+        writeFileSync16(absolute, content);
       }
       initShadowGitRoot(memberShadowRoot);
       shadowBindings[member.repositoryId] = memberShadowRoot;
@@ -30399,15 +30482,15 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
       throw error;
     }
   } finally {
-    rmSync6(shadow, { recursive: true, force: true });
+    rmSync7(shadow, { recursive: true, force: true });
   }
 }
 function portableMemberPathHint(pathHint) {
   return pathHint !== "." && vnextPortablePath(pathHint);
 }
 function loadBaseProjectDeclarations(projectFile) {
-  if (!existsSync18(projectFile)) return [];
-  const value = parseRestrictedYaml2(readFileSync19(projectFile, "utf8"), ".kxm/project.yaml");
+  if (!existsSync20(projectFile)) return [];
+  const value = parseRestrictedYaml2(readFileSync20(projectFile, "utf8"), ".kxm/project.yaml");
   const repositories = Array.isArray(value?.repositories) ? value.repositories : [];
   const members = [];
   for (const entry of repositories) {
@@ -30499,7 +30582,7 @@ function writeDurableNew(file, bytes, mode) {
   let descriptor;
   try {
     descriptor = openSync2(file, "wx", mode);
-    writeFileSync16(descriptor, bytes);
+    writeFileSync17(descriptor, bytes);
     fsyncSync2(descriptor);
     closeSync2(descriptor);
     descriptor = void 0;
@@ -30510,13 +30593,13 @@ function writeDurableNew(file, bytes, mode) {
   } finally {
     if (descriptor !== void 0) closeSync2(descriptor);
   }
-  syncDirectory2(dirname13(file));
+  syncDirectory2(dirname15(file));
 }
 function writeDurable(file, bytes, mode) {
   let descriptor;
   try {
     descriptor = openSync2(file, "w", mode);
-    writeFileSync16(descriptor, bytes);
+    writeFileSync17(descriptor, bytes);
     fsyncSync2(descriptor);
     closeSync2(descriptor);
     descriptor = void 0;
@@ -30527,7 +30610,7 @@ function writeDurable(file, bytes, mode) {
   } finally {
     if (descriptor !== void 0) closeSync2(descriptor);
   }
-  syncDirectory2(dirname13(file));
+  syncDirectory2(dirname15(file));
 }
 function sameHostPath3(left, right) {
   const first = resolve18(left);
@@ -30535,45 +30618,45 @@ function sameHostPath3(left, right) {
   return process.platform === "win32" ? first.toLocaleLowerCase("en-US") === second.toLocaleLowerCase("en-US") : first === second;
 }
 function transactionRoot(projectRoot) {
-  return join22(resolve18(projectRoot), TRANSACTION_NAME);
+  return join24(resolve18(projectRoot), TRANSACTION_NAME);
 }
 function operationFile(projectRoot) {
-  return join22(transactionRoot(projectRoot), OPERATION_FILE);
+  return join24(transactionRoot(projectRoot), OPERATION_FILE);
 }
 function targetFile(projectRoot, portablePath2) {
-  return join22(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
+  return join24(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
 }
 function shadowRoot(projectRoot) {
-  return join22(transactionRoot(projectRoot), "shadow");
+  return join24(transactionRoot(projectRoot), "shadow");
 }
 function backupFile(projectRoot, portablePath2) {
-  return join22(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
+  return join24(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
 }
 function portableManagedPath(path4) {
-  return path4.startsWith(".kxm/") && path4 !== VNEXT_TEMPLATE_PROVENANCE_PATH && path4.length <= 1024 && !path4.includes("\\") && !isAbsolute6(path4) && PORTABLE_PATH.test(path4) && !/[<>:"|?*]/.test(path4);
+  return path4.startsWith(".kxm/") && path4 !== VNEXT_TEMPLATE_PROVENANCE_PATH && path4.length <= 1024 && !path4.includes("\\") && !isAbsolute7(path4) && PORTABLE_PATH.test(path4) && !/[<>:"|?*]/.test(path4);
 }
 function readRegularBounded(file, label) {
   const stat = lstatSync7(file);
   if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_file_invalid", label, "managed file must be a regular file, not a link or directory", "path");
   if (stat.size > MAX_MANAGED_FILE_BYTES) fail3("repair_file_too_large", label, `managed file exceeds ${MAX_MANAGED_FILE_BYTES} bytes`, "parse");
-  return readFileSync20(file);
+  return readFileSync21(file);
 }
 function readOptionalManaged(projectRoot, path4) {
-  const file = join22(projectRoot, ...path4.split("/"));
-  if (!existsSync19(file)) return void 0;
-  let parent = dirname13(file);
+  const file = join24(projectRoot, ...path4.split("/"));
+  if (!existsSync21(file)) return void 0;
+  let parent = dirname15(file);
   const boundary = resolve18(projectRoot);
   while (parent !== boundary) {
     const stat = lstatSync7(parent);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_parent_invalid", path4, "managed file parents must be regular directories", "path");
-    parent = dirname13(parent);
+    parent = dirname15(parent);
   }
   return readRegularBounded(file, path4);
 }
 function readProjectAndProvenance(projectRoot, schemasDir) {
-  const projectFile = join22(projectRoot, ".kxm", "project.yaml");
-  const provenanceFile = join22(projectRoot, ...VNEXT_TEMPLATE_PROVENANCE_PATH.split("/"));
-  if (!existsSync19(projectFile) || !existsSync19(provenanceFile)) return void 0;
+  const projectFile = join24(projectRoot, ".kxm", "project.yaml");
+  const provenanceFile = join24(projectRoot, ...VNEXT_TEMPLATE_PROVENANCE_PATH.split("/"));
+  if (!existsSync21(projectFile) || !existsSync21(provenanceFile)) return void 0;
   const projectBytes = readOptionalManaged(projectRoot, ".kxm/project.yaml");
   const provenanceBytes = readOptionalManaged(projectRoot, VNEXT_TEMPLATE_PROVENANCE_PATH);
   if (!projectBytes || !provenanceBytes) return void 0;
@@ -30737,14 +30820,14 @@ function operationPlanSha(operation) {
 function writeOperation(projectRoot, operation) {
   const root = transactionRoot(projectRoot);
   const file = operationFile(projectRoot);
-  const temporary = join22(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
+  const temporary = join24(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
   try {
     writeDurableNew(temporary, Buffer.from(`${JSON.stringify(operation, null, 2)}
 `, "utf8"), 384);
-    renameSync5(temporary, file);
+    renameSync6(temporary, file);
     syncDirectory2(root);
   } finally {
-    rmSync7(temporary, { force: true });
+    rmSync8(temporary, { force: true });
   }
 }
 function updatePhase(projectRoot, operation, phase) {
@@ -30754,11 +30837,11 @@ function updatePhase(projectRoot, operation, phase) {
 }
 function readOperation(projectRoot, schemasDir) {
   const root = transactionRoot(projectRoot);
-  if (!existsSync19(root)) return void 0;
+  if (!existsSync21(root)) return void 0;
   const stat = lstatSync7(root);
   if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("init_transaction_invalid", TRANSACTION_NAME, "initialization transaction must be a regular directory", "path");
   const file = operationFile(projectRoot);
-  if (!existsSync19(file)) {
+  if (!existsSync21(file)) {
     const entries = readdirSync7(root, { withFileTypes: true });
     const recoverable = entries.every((entry) => entry.isFile() && /^\.operation-op_[a-f0-9]{32}-[a-f0-9-]{36}\.tmp$/.test(entry.name));
     if (recoverable) return void 0;
@@ -30781,20 +30864,20 @@ function readOperation(projectRoot, schemasDir) {
     seen.add(folded);
     prior = entry.path;
   }
-  if (!isAbsolute6(operation.projectRoot)) fail3("init_transaction_project_root_invalid", TRANSACTION_NAME, "operation project root must be absolute", "path");
+  if (!isAbsolute7(operation.projectRoot)) fail3("init_transaction_project_root_invalid", TRANSACTION_NAME, "operation project root must be absolute", "path");
   validateOperationIntent(projectRoot, operation);
   return operation;
 }
 function hasVnextInitTransaction(projectRoot) {
-  return existsSync19(transactionRoot(projectRoot));
+  return existsSync21(transactionRoot(projectRoot));
 }
 function readTarget(projectRoot, path4) {
-  return readOptionalManaged(join22(transactionRoot(projectRoot), "targets"), path4);
+  return readOptionalManaged(join24(transactionRoot(projectRoot), "targets"), path4);
 }
 function writeTarget(projectRoot, path4, bytes) {
   if (bytes.byteLength > MAX_MANAGED_FILE_BYTES) fail3("template_target_too_large", path4, `target exceeds ${MAX_MANAGED_FILE_BYTES} bytes`);
   const file = targetFile(projectRoot, path4);
-  mkdirSync17(dirname13(file), { recursive: true, mode: 448 });
+  mkdirSync18(dirname15(file), { recursive: true, mode: 448 });
   writeDurableNew(file, bytes, 384);
 }
 function writeAndVerifyBackups(projectRoot, operation) {
@@ -30806,7 +30889,7 @@ function writeAndVerifyBackups(projectRoot, operation) {
       fail3("repair_preimage_changed", entry.path, "destination changed before transaction preparation; local bytes were preserved");
     }
     const file = backupFile(projectRoot, entry.path);
-    mkdirSync17(dirname13(file), { recursive: true, mode: 448 });
+    mkdirSync18(dirname15(file), { recursive: true, mode: 448 });
     writeDurableNew(file, current, 384);
   }
 }
@@ -30821,7 +30904,7 @@ function writeKnownBackups(projectRoot, operation) {
       fail3("init_transaction_backup_source_invalid", entry.path, "supported source template cannot reproduce the pinned preimage");
     }
     const file = backupFile(projectRoot, entry.path);
-    mkdirSync17(dirname13(file), { recursive: true, mode: 448 });
+    mkdirSync18(dirname15(file), { recursive: true, mode: 448 });
     writeDurableNew(file, bytes, 384);
   }
 }
@@ -30829,7 +30912,7 @@ function verifyBackups(projectRoot, operation) {
   if (operation.kind !== "repair") return;
   for (const entry of operation.files) {
     if (entry.observedSha256 === null) continue;
-    const bytes = readOptionalManaged(join22(transactionRoot(projectRoot), "backups"), entry.path);
+    const bytes = readOptionalManaged(join24(transactionRoot(projectRoot), "backups"), entry.path);
     if (!bytes || vnextContentSha256(bytes) !== entry.observedSha256) {
       fail3("init_transaction_backup_invalid", entry.path, "pinned preimage backup is missing or corrupt");
     }
@@ -30863,10 +30946,10 @@ function sourceConfigFiles(projectRoot) {
     ".kxm/repo/repo.yaml",
     ".kxm/repo/env.yaml"
   ];
-  const files = fixed.filter((path4) => existsSync19(join22(projectRoot, ...path4.split("/"))));
+  const files = fixed.filter((path4) => existsSync21(join24(projectRoot, ...path4.split("/"))));
   for (const directory of ["agents", "models", "workflows"]) {
-    const absolute = join22(projectRoot, ".kxm", directory);
-    if (!existsSync19(absolute)) continue;
+    const absolute = join24(projectRoot, ".kxm", directory);
+    if (!existsSync21(absolute)) continue;
     const stat = lstatSync7(absolute);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_directory_invalid", `.kxm/${directory}`, "configuration directory must be regular", "path");
     for (const entry of readdirSync7(absolute, { withFileTypes: true })) {
@@ -30888,23 +30971,23 @@ function absoluteMemberBindings(projectRoot, project, explicit = {}) {
     if (repository.role !== "member" || typeof repository.id !== "string" || Object.hasOwn(bindings, repository.id)) continue;
     if (typeof repository.pathHint === "string") {
       const candidate2 = resolve18(projectRoot, ...repository.pathHint.split("/"));
-      if (existsSync19(candidate2)) bindings[repository.id] = candidate2;
+      if (existsSync21(candidate2)) bindings[repository.id] = candidate2;
     }
   }
   return bindings;
 }
 function prepareShadow(projectRoot, operation, options) {
   const shadow = shadowRoot(projectRoot);
-  mkdirSync17(shadow, { recursive: true, mode: 448 });
+  mkdirSync18(shadow, { recursive: true, mode: 448 });
   let total = 0;
   if (operation.kind === "repair") {
     for (const path4 of sourceConfigFiles(projectRoot)) {
       const bytes = readOptionalManaged(projectRoot, path4);
       if (!bytes) fail3("repair_snapshot_file_missing", path4, "configuration changed during shadow preparation");
       total += bytes.byteLength;
-      const source = join22(projectRoot, ...path4.split("/"));
-      const destination = join22(shadow, ...path4.split("/"));
-      mkdirSync17(dirname13(destination), { recursive: true, mode: 448 });
+      const source = join24(projectRoot, ...path4.split("/"));
+      const destination = join24(shadow, ...path4.split("/"));
+      mkdirSync18(dirname15(destination), { recursive: true, mode: 448 });
       writeDurableNew(destination, bytes, lstatSync7(source).mode & 511);
       if (total > MAX_MANAGED_TOTAL_BYTES) fail3("repair_snapshot_too_large", ".kxm", `configuration snapshot exceeds ${MAX_MANAGED_TOTAL_BYTES} bytes`, "parse");
     }
@@ -30912,12 +30995,12 @@ function prepareShadow(projectRoot, operation, options) {
   for (const entry of operation.files) {
     const bytes = readTarget(projectRoot, entry.path);
     if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-    const destination = join22(shadow, ...entry.path.split("/"));
-    mkdirSync17(dirname13(destination), { recursive: true, mode: 448 });
-    const mode = existsSync19(destination) ? lstatSync7(destination).mode & 511 : 420;
+    const destination = join24(shadow, ...entry.path.split("/"));
+    mkdirSync18(dirname15(destination), { recursive: true, mode: 448 });
+    const mode = existsSync21(destination) ? lstatSync7(destination).mode & 511 : 420;
     writeDurable(destination, bytes, mode);
   }
-  const project = parseRestrictedYaml2(readFileSync20(join22(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
+  const project = parseRestrictedYaml2(readFileSync21(join24(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
   const bound = absoluteMemberBindings(projectRoot, project, options.repositoryBindings);
   loadVnextProject(shadow, { ...loaderOptions(options), repositoryBindings: bound });
   const provenance = readProjectAndProvenance(shadow, options.schemasDir)?.provenance;
@@ -30955,8 +31038,8 @@ function prepareOperation(projectRoot, operation, rendered, options) {
   const transaction = transactionRoot(projectRoot);
   validateOperationRecord(operation, options.schemasDir);
   validateOperationIntent(projectRoot, operation);
-  if (existsSync19(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
-  mkdirSync17(transaction, { mode: 448 });
+  if (existsSync21(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
+  mkdirSync18(transaction, { mode: 448 });
   syncDirectory2(projectRoot);
   writeOperation(projectRoot, operation);
   try {
@@ -30972,7 +31055,7 @@ function prepareOperation(projectRoot, operation, rendered, options) {
     syncTreeDirectories(transaction);
     return updatePhase(projectRoot, operation, "prepared");
   } catch (error) {
-    rmSync7(transaction, { recursive: true, force: true });
+    rmSync8(transaction, { recursive: true, force: true });
     throw error;
   }
 }
@@ -30981,21 +31064,21 @@ function ensureDestinationParents(projectRoot, path4) {
   const segments = path4.split("/").slice(0, -1);
   let current = boundary;
   for (const segment of segments) {
-    current = join22(current, segment);
-    if (!existsSync19(current)) mkdirSync17(current, { mode: 448 });
+    current = join24(current, segment);
+    if (!existsSync21(current)) mkdirSync18(current, { mode: 448 });
     const stat = lstatSync7(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_destination_parent_invalid", path4, "destination parent must be a regular directory", "path");
   }
 }
 function destinationSha(projectRoot, path4) {
-  const file = join22(projectRoot, ...path4.split("/"));
-  if (!existsSync19(file)) return void 0;
+  const file = join24(projectRoot, ...path4.split("/"));
+  if (!existsSync21(file)) return void 0;
   return vnextContentSha256(readRegularBounded(file, path4));
 }
 function requireConditionalLinkSupport(directory, operationId, path4) {
   const nonce = randomUUID10();
-  const source = join22(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
-  const target = join22(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
+  const source = join24(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
+  const target = join24(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
   try {
     writeDurableNew(source, Buffer.from("kxm-link-probe\n", "utf8"), 384);
     try {
@@ -31004,25 +31087,25 @@ function requireConditionalLinkSupport(directory, operationId, path4) {
       fail3("repair_hard_link_unsupported", path4, "filesystem does not support the conditional hard-link install required for safe repair");
     }
   } finally {
-    rmSync7(target, { force: true });
-    rmSync7(source, { force: true });
+    rmSync8(target, { force: true });
+    rmSync8(source, { force: true });
     syncDirectory2(directory);
   }
 }
 function atomicInstallTarget(projectRoot, operation, entry) {
-  const destination = join22(projectRoot, ...entry.path.split("/"));
+  const destination = join24(projectRoot, ...entry.path.split("/"));
   ensureDestinationParents(projectRoot, entry.path);
-  const directory = dirname13(destination);
+  const directory = dirname15(destination);
   const temporaryPrefix = `.kxm-repair-${operation.operationId}-`;
   const pathKey = vnextContentSha256(entry.path).slice("sha256:".length, "sha256:".length + 16);
-  const displaced = join22(directory, `${temporaryPrefix}${pathKey}.preimage`);
-  if (existsSync19(displaced)) {
+  const displaced = join24(directory, `${temporaryPrefix}${pathKey}.preimage`);
+  if (existsSync21(displaced)) {
     const stat = lstatSync7(displaced);
     if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_preimage_temporary_invalid", entry.path, "stale displaced preimage is not a regular file", "path");
-    if (entry.observedSha256 === null || vnextContentSha256(readFileSync20(displaced)) !== entry.observedSha256) {
+    if (entry.observedSha256 === null || vnextContentSha256(readFileSync21(displaced)) !== entry.observedSha256) {
       fail3("repair_preimage_temporary_mismatch", entry.path, "stale displaced preimage does not match the pinned operation");
     }
-    if (!existsSync19(destination)) {
+    if (!existsSync21(destination)) {
       try {
         linkSync(displaced, destination);
       } catch {
@@ -31030,14 +31113,14 @@ function atomicInstallTarget(projectRoot, operation, entry) {
       }
       syncDirectory2(directory);
     }
-    rmSync7(displaced, { force: true });
+    rmSync8(displaced, { force: true });
     syncDirectory2(directory);
   }
   for (const candidate of readdirSync7(directory, { withFileTypes: true })) {
     const owned = candidate.name.startsWith(temporaryPrefix) && (candidate.name.endsWith(".tmp") || candidate.name.endsWith(".link-source") || candidate.name.endsWith(".link-target"));
     if (!owned) continue;
     if (!candidate.isFile()) fail3("repair_temporary_invalid", entry.path, "stale operation temporary is not a regular file", "path");
-    rmSync7(join22(directory, candidate.name), { force: true });
+    rmSync8(join24(directory, candidate.name), { force: true });
   }
   const current = destinationSha(projectRoot, entry.path);
   if (current === entry.targetSha256) return;
@@ -31047,22 +31130,22 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   requireConditionalLinkSupport(directory, operation.operationId, entry.path);
   const bytes = readTarget(projectRoot, entry.path);
   if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-  const temporary = join22(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
-  const mode = existsSync19(destination) ? lstatSync7(destination).mode & 511 : 420;
+  const temporary = join24(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
+  const mode = existsSync21(destination) ? lstatSync7(destination).mode & 511 : 420;
   try {
     writeDurableNew(temporary, bytes, mode);
     if (entry.observedSha256 !== null) {
-      renameSync5(destination, displaced);
+      renameSync6(destination, displaced);
       syncDirectory2(directory);
-      if (vnextContentSha256(readFileSync20(displaced)) !== entry.observedSha256) {
-        if (!existsSync19(destination)) {
+      if (vnextContentSha256(readFileSync21(displaced)) !== entry.observedSha256) {
+        if (!existsSync21(destination)) {
           try {
             linkSync(displaced, destination);
           } catch {
             fail3("repair_preimage_restore_blocked", entry.path, "changed destination was displaced but could not be conditionally restored; its bytes remain in the operation preimage file");
           }
           syncDirectory2(directory);
-          rmSync7(displaced, { force: true });
+          rmSync8(displaced, { force: true });
           syncDirectory2(directory);
         }
         fail3("repair_preimage_changed", entry.path, "destination changed at replacement time; concurrent bytes were preserved at the destination or in the operation preimage file");
@@ -31071,7 +31154,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
     try {
       linkSync(temporary, destination);
     } catch {
-      if (!existsSync19(destination) && existsSync19(displaced)) {
+      if (!existsSync21(destination) && existsSync21(displaced)) {
         try {
           linkSync(displaced, destination);
         } catch {
@@ -31079,26 +31162,26 @@ function atomicInstallTarget(projectRoot, operation, entry) {
         }
         syncDirectory2(directory);
       }
-      rmSync7(displaced, { force: true });
+      rmSync8(displaced, { force: true });
       syncDirectory2(directory);
       fail3("repair_destination_recreated", entry.path, "destination was recreated concurrently or conditional install is unsupported; pinned target was not installed");
     }
     syncDirectory2(directory);
-    rmSync7(temporary, { force: true });
-    rmSync7(displaced, { force: true });
+    rmSync8(temporary, { force: true });
+    rmSync8(displaced, { force: true });
     syncDirectory2(directory);
   } finally {
-    rmSync7(temporary, { force: true });
+    rmSync8(temporary, { force: true });
   }
   if (destinationSha(projectRoot, entry.path) !== entry.targetSha256) fail3("repair_install_verification_failed", entry.path, "installed target hash does not match the pinned operation");
 }
 function installedCreateMatches(projectRoot, operation) {
-  const configRoot = join22(projectRoot, ".kxm");
-  if (!existsSync19(configRoot)) return false;
+  const configRoot = join24(projectRoot, ".kxm");
+  if (!existsSync21(configRoot)) return false;
   const actual = [];
   const visit2 = (directory) => {
     for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      const absolute = join22(directory, entry.name);
+      const absolute = join24(directory, entry.name);
       if (entry.isSymbolicLink()) fail3("create_resume_link", relativeConfigPath(projectRoot, absolute), "created configuration must not contain links", "path");
       if (entry.isDirectory()) visit2(absolute);
       else if (entry.isFile()) actual.push(relativeConfigPath(projectRoot, absolute));
@@ -31114,12 +31197,12 @@ function relativeConfigPath(projectRoot, file) {
   return relative4(resolve18(projectRoot), file).replaceAll("\\", "/");
 }
 function syncTreeDirectories(root) {
-  if (!existsSync19(root)) return;
+  if (!existsSync21(root)) return;
   const directories = [];
   const visit2 = (directory) => {
     directories.push(directory);
     for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      if (entry.isDirectory()) visit2(join22(directory, entry.name));
+      if (entry.isDirectory()) visit2(join24(directory, entry.name));
     }
   };
   visit2(root);
@@ -31127,13 +31210,13 @@ function syncTreeDirectories(root) {
 }
 function rebuildCreateShadow(projectRoot, operation, options) {
   const shadow = shadowRoot(projectRoot);
-  rmSync7(shadow, { recursive: true, force: true });
+  rmSync8(shadow, { recursive: true, force: true });
   prepareShadow(projectRoot, operation, options);
   const stat = lstatSync7(shadow);
   if (stat.isSymbolicLink() || !stat.isDirectory() || !installedCreateMatches(shadow, operation)) {
     fail3("create_shadow_invalid", TRANSACTION_NAME, "reconstructed create shadow does not exactly match pinned target files", "path");
   }
-  syncTreeDirectories(join22(shadow, ".kxm"));
+  syncTreeDirectories(join24(shadow, ".kxm"));
 }
 function applyOperation(projectRoot, original, options, resumed) {
   assertNoRegisteredGates(options);
@@ -31143,10 +31226,10 @@ function applyOperation(projectRoot, original, options, resumed) {
   verifyBackups(projectRoot, operation);
   operation = updatePhase(projectRoot, operation, "applying");
   if (operation.kind === "create") {
-    const destination = join22(projectRoot, ".kxm");
-    if (!existsSync19(destination)) {
+    const destination = join24(projectRoot, ".kxm");
+    if (!existsSync21(destination)) {
       rebuildCreateShadow(projectRoot, operation, effectiveOptions);
-      renameSync5(join22(shadowRoot(projectRoot), ".kxm"), destination);
+      renameSync6(join24(shadowRoot(projectRoot), ".kxm"), destination);
       syncDirectory2(projectRoot);
     } else if (!installedCreateMatches(projectRoot, operation)) {
       fail3("create_resume_conflict", ".kxm", "existing project configuration does not match the pinned create operation");
@@ -31173,7 +31256,7 @@ function applyOperation(projectRoot, original, options, resumed) {
   operation = updatePhase(projectRoot, operation, "verified");
   if (options.testFaultAt === "verified") throw new Error("injected init fault after verification");
   const files = operation.files.map((entry) => entry.path);
-  syncTreeDirectories(join22(projectRoot, ".kxm"));
+  syncTreeDirectories(join24(projectRoot, ".kxm"));
   return { kind: operation.kind, resumed, bundle, files };
 }
 function prepareAndApplyVnextCreate(projectRoot, rendered, options = {}) {
@@ -31288,7 +31371,7 @@ function finishPreparingOperation(projectRoot, operation, options) {
   const rendered = rendererForOperation(operation);
   if (!rendered) fail3("init_transaction_renderer_unavailable", TRANSACTION_NAME, "this binary cannot reproduce the pinned pre-application target");
   for (const directory of ["targets", "backups", "shadow"]) {
-    rmSync7(join22(transactionRoot(projectRoot), directory), { recursive: true, force: true });
+    rmSync8(join24(transactionRoot(projectRoot), directory), { recursive: true, force: true });
   }
   for (const entry of operation.files) {
     const bytes = rendered.files.get(entry.path);
@@ -31307,8 +31390,8 @@ function resumeVnextInitTransaction(projectRoot, options = {}) {
   let operation = readOperation(projectRoot, options.schemasDir);
   if (!operation) {
     const root = transactionRoot(projectRoot);
-    if (existsSync19(root)) {
-      rmSync7(root, { recursive: true, force: true });
+    if (existsSync21(root)) {
+      rmSync8(root, { recursive: true, force: true });
       syncDirectory2(projectRoot);
     }
     return void 0;
@@ -31323,10 +31406,10 @@ function commitVnextInitTransaction(projectRoot, schemasDir) {
     fail3("init_transaction_not_verified", TRANSACTION_NAME, "initialization transaction cannot commit before installed state is verified");
   }
   const transaction = transactionRoot(projectRoot);
-  const retired = join22(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
-  renameSync5(transaction, retired);
+  const retired = join24(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
+  renameSync6(transaction, retired);
   syncDirectory2(projectRoot);
-  rmSync7(retired, { recursive: true, force: true });
+  rmSync8(retired, { recursive: true, force: true });
   syncDirectory2(projectRoot);
 }
 function inspectVnextInitTransaction(projectRoot, schemasDir) {
@@ -31432,7 +31515,7 @@ function validateBindingIdentities(bundle, persisted, explicit) {
 }
 function initializeVnextProjectAtGitRoot(start, gitRoot, options, mutationLock) {
   const storeOptions = bindingStoreOptions(options);
-  const persisted = existsSync20(join23(gitRoot, ".kxm", "project.yaml")) ? readVnextLocalBindings(gitRoot, storeOptions) : void 0;
+  const persisted = existsSync22(join25(gitRoot, ".kxm", "project.yaml")) ? readVnextLocalBindings(gitRoot, storeOptions) : void 0;
   const repositoryBindings = Object.fromEntries([
     ...Object.entries(persisted?.repositories ?? {}),
     ...Object.entries(options.repositoryBindings ?? {})
@@ -31621,7 +31704,7 @@ function initializeVnextProjectAtGitRoot(start, gitRoot, options, mutationLock)
   const files = [...rendered.files.keys()];
   if (options.dryRun) return { action: "planned", plan, projectRoot: gitRoot, files };
   if (!mutationLock) throw new Error("project mutation lock is required to create configuration");
-  if (existsSync20(join23(gitRoot, ".kxm"))) {
+  if (existsSync22(join25(gitRoot, ".kxm"))) {
     throw new VnextConfigError([initIssue("workspace_changed", ".kxm", "workspace changed after planning; existing .kxm state was not overwritten")]);
   }
   const created = prepareAndApplyVnextCreate(gitRoot, rendered, transactionOptions);
@@ -31653,8 +31736,8 @@ function initializeVnextProject(start = process.cwd(), options = {}) {
 // plugins/kxm/src/vnext-migrate.ts
 var import_yaml12 = __toESM(require_dist(), 1);
 import { createHash as createHash13 } from "node:crypto";
-import { chmodSync as chmodSync6, closeSync as closeSync3, existsSync as existsSync21, fsyncSync as fsyncSync3, lstatSync as lstatSync8, mkdirSync as mkdirSync18, openSync as openSync3, readFileSync as readFileSync21, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "node:fs";
-import { join as join24 } from "node:path";
+import { chmodSync as chmodSync6, closeSync as closeSync3, existsSync as existsSync23, fsyncSync as fsyncSync3, lstatSync as lstatSync8, mkdirSync as mkdirSync19, openSync as openSync3, readFileSync as readFileSync22, renameSync as renameSync7, rmSync as rmSync9, writeFileSync as writeFileSync18 } from "node:fs";
+import { join as join26 } from "node:path";
 var MAX_LEGACY_JSON_BYTES = 1024 * 1024;
 var MAX_LEGACY_JSON_DEPTH = 32;
 var MAX_LEGACY_JSON_NODES = 32768;
@@ -31823,12 +31906,12 @@ function readVnextLegacySources(root) {
     throw new VnextConfigError([migrateIssue("discovery", "legacy_source_limit", ".kxm/config", `legacy configuration exceeds ${MAX_LEGACY_SOURCES} files`)]);
   }
   return files.map((path4) => {
-    const absolute = join24(root, ...path4.split("/"));
+    const absolute = join26(root, ...path4.split("/"));
     const stat = lstatSync8(absolute);
     if (stat.isSymbolicLink() || !stat.isFile()) {
       throw new VnextConfigError([migrateIssue("path", "legacy_source_invalid", path4, "legacy configuration must be a regular file, not a link")]);
     }
-    const buffer = readFileSync21(absolute);
+    const buffer = readFileSync22(absolute);
     let text;
     try {
       text = new TextDecoder("utf-8", { fatal: true }).decode(buffer);
@@ -32901,11 +32984,11 @@ function planVnextMigration(projectRoot, options = {}) {
   };
 }
 function readVnextMigrationDecisions(path4, schemasDir) {
-  if (!existsSync21(path4)) {
+  if (!existsSync23(path4)) {
     throw new VnextConfigError([migrateIssue("discovery", "decisions_missing", path4, "migration decisions file does not exist")]);
   }
   const registry = new VnextSchemaRegistry(schemasDir);
-  const value = parseRestrictedYaml2(readFileSync21(path4), path4);
+  const value = parseRestrictedYaml2(readFileSync22(path4), path4);
   const issues = registry.validateMigrationDecision(value, path4);
   if (issues.length > 0) throw new VnextConfigError(issues);
   return value;
@@ -32934,19 +33017,19 @@ function writeDurable2(path4, content) {
     const descriptor = openSync3(temp, "wx", 384);
     created = true;
     try {
-      writeFileSync17(descriptor, content);
+      writeFileSync18(descriptor, content);
       fsyncSync3(descriptor);
     } finally {
       closeSync3(descriptor);
     }
-    renameSync6(temp, path4);
+    renameSync7(temp, path4);
     try {
       chmodSync6(path4, 384);
     } catch {
     }
-    syncDirectory3(join24(path4, ".."));
+    syncDirectory3(join26(path4, ".."));
   } finally {
-    if (created && existsSync21(temp)) rmSync8(temp, { force: true });
+    if (created && existsSync23(temp)) rmSync9(temp, { force: true });
   }
 }
 function applyVnextMigration(projectRoot, options = {}) {
@@ -32956,8 +33039,8 @@ function applyVnextMigration(projectRoot, options = {}) {
     ...options.schemasDir === void 0 ? {} : { schemasDir: options.schemasDir }
   };
   const execute = (lock) => {
-    const receiptAbsolute = join24(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
-    if (existsSync21(receiptAbsolute)) {
+    const receiptAbsolute = join26(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+    if (existsSync23(receiptAbsolute)) {
       const stat = lstatSync8(receiptAbsolute);
       if (stat.isSymbolicLink() || !stat.isFile()) {
         throw new VnextConfigError([migrateIssue("path", "migration_receipt_invalid", VNEXT_MIGRATION_RECEIPT_PATH, "migration receipt must be a regular file, not a link")]);
@@ -33010,7 +33093,7 @@ function applyVnextMigration(projectRoot, options = {}) {
       return { action: "planned", projectRoot: root, files: [], plan: first.plan };
     }
     const files = [...first.resources.entries()].sort(([left], [right]) => compareCodeUnits6(left, right)).map(([path4, value]) => ({ path: path4, bytes: Buffer.from((0, import_yaml12.stringify)(value, { lineWidth: 0 }), "utf8") }));
-    const collisions = files.filter((file) => existsSync21(join24(root, ...file.path.split("/"))));
+    const collisions = files.filter((file) => existsSync23(join26(root, ...file.path.split("/"))));
     if (collisions.length > 0) {
       throw new VnextConfigError(collisions.map((file) => migrateIssue("semantic", "migration_target_exists", file.path, "target resource already exists; refusing to overwrite")));
     }
@@ -33019,8 +33102,8 @@ function applyVnextMigration(projectRoot, options = {}) {
       const segments = file.path.split("/");
       let current = root;
       for (const segment of segments.slice(0, -1)) {
-        current = join24(current, segment);
-        if (!existsSync21(current)) continue;
+        current = join26(current, segment);
+        if (!existsSync23(current)) continue;
         const stat = lstatSync8(current);
         if (stat.isSymbolicLink() || !stat.isDirectory()) {
           parentIssues.push(migrateIssue("path", "migration_target_parent_invalid", file.path, `migration target parent ${segment} must be a regular directory, not a link`));
@@ -33036,8 +33119,8 @@ function applyVnextMigration(projectRoot, options = {}) {
     const written = [];
     try {
       for (const file of files) {
-        const absolute = join24(root, ...file.path.split("/"));
-        mkdirSync18(join24(absolute, ".."), { recursive: true });
+        const absolute = join26(root, ...file.path.split("/"));
+        mkdirSync19(join26(absolute, ".."), { recursive: true });
         written.push(absolute);
         writeDurable2(absolute, file.bytes);
       }
@@ -33071,7 +33154,7 @@ ${bundle.configRevision}`).slice(7, 39)}`,
     } catch (error) {
       for (const absolute of written.reverse()) {
         try {
-          rmSync8(absolute, { force: true });
+          rmSync9(absolute, { force: true });
         } catch {
         }
       }
@@ -33083,8 +33166,8 @@ ${bundle.configRevision}`).slice(7, 39)}`,
 }
 function verifyVnextMigration(projectRoot, options = {}) {
   const root = migrationGitRoot(projectRoot);
-  const receiptAbsolute = join24(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
-  if (!existsSync21(receiptAbsolute)) {
+  const receiptAbsolute = join26(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+  if (!existsSync23(receiptAbsolute)) {
     return {
       ok: false,
       projectRoot: root,
@@ -33132,7 +33215,6 @@ function verifyVnextMigration(projectRoot, options = {}) {
 
 // plugins/kxm/src/cli/vnext.ts
 var vnextDriveCliSeams = {};
-var repoRoot3 = resolve20(fileURLToPath4(new URL("../../../../", import.meta.url)));
 function initPlanPayload(plan) {
   return {
     mode: plan.mode,
@@ -33394,7 +33476,7 @@ async function cmdBackup(runtime, options) {
     const summary = [
       `Created SQLite backup with ${manifest.stores.length} store(s):`,
       ...manifest.stores.map((s) => `  - ${s.storeId}: ${s.sourcePath} -> ${s.backupFile} (schema v${s.schemaVersion}, ${s.bytes} bytes, sha256 ${s.sha256.slice(0, 12)}...)`),
-      `Manifest: ${join25(outDir, "manifest.json")}`
+      `Manifest: ${join27(outDir, "manifest.json")}`
     ].join("\n");
     print(runtime.io, runtime.json, payload, summary);
     return 0;
@@ -33963,8 +34045,8 @@ async function cmdStudioLayout(runtime, workflowPath) {
     }
     let yamlContent;
     let workflowId = "default";
-    if (existsSync22(filePath)) {
-      yamlContent = readFileSync22(filePath, "utf8");
+    if (existsSync24(filePath)) {
+      yamlContent = readFileSync23(filePath, "utf8");
     } else {
       yamlContent = `schema: kxm.workflow.v1
 description: Feature implementation workflow
@@ -34037,15 +34119,15 @@ async function cmdStudioServe(runtime, options) {
       sessionToken,
       planProvider: () => {
         try {
-          const wfDir = join26(runtime.cwd, ".kxm", "workflows");
-          const defaultPath = join26(wfDir, "default.yaml");
-          let targetPath = existsSync22(defaultPath) ? defaultPath : void 0;
-          if (!targetPath && existsSync22(wfDir)) {
+          const wfDir = join28(runtime.cwd, ".kxm", "workflows");
+          const defaultPath = join28(wfDir, "default.yaml");
+          let targetPath = existsSync24(defaultPath) ? defaultPath : void 0;
+          if (!targetPath && existsSync24(wfDir)) {
             const yml = readdirSync8(wfDir).find((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
-            if (yml) targetPath = join26(wfDir, yml);
+            if (yml) targetPath = join28(wfDir, yml);
           }
-          if (targetPath && existsSync22(targetPath)) {
-            const raw = readFileSync22(targetPath, "utf8");
+          if (targetPath && existsSync24(targetPath)) {
+            const raw = readFileSync23(targetPath, "utf8");
             const parsed = (0, import_yaml13.parse)(raw);
             const wfId = basename6(targetPath).replace(/\.(yaml|yml)$/, "");
             return compileVnextWorkflow({ id: wfId, value: parsed });
@@ -34095,14 +34177,14 @@ Press Ctrl+C to stop.
 }
 
 // plugins/kxm/src/cli/context-skills.ts
-import { readFileSync as readFileSync25 } from "node:fs";
-import { join as join30, relative as relative5 } from "node:path";
+import { readFileSync as readFileSync26 } from "node:fs";
+import { join as join32, relative as relative5 } from "node:path";
 
 // plugins/kxm/src/memory.ts
 var import_yaml14 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync19, readdirSync as readdirSync9, readFileSync as readFileSync23, writeFileSync as writeFileSync18 } from "node:fs";
-import { extname as extname2, join as join27, resolve as resolve22 } from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync20, readdirSync as readdirSync9, readFileSync as readFileSync24, writeFileSync as writeFileSync19 } from "node:fs";
+import { extname as extname2, join as join29, resolve as resolve22 } from "node:path";
 var MEMORY_SCHEMA = "kxm.memory.v1";
 var MEMORY_BRIEF_SCHEMA = "kxm.memory-brief.v1";
 var MEMORY_MARKER_START = "<!-- kxm:memory:start -->";
@@ -34227,22 +34309,22 @@ ${yamlText}
 ---
 `;
 }
-function memoryDirectories(repoRoot6) {
-  const root = resolve22(repoRoot6);
-  const memoryDir = join27(root, ".kxm", "memory");
-  const candidatesDir = join27(memoryDir, "candidates");
+function memoryDirectories(repoRoot) {
+  const root = resolve22(repoRoot);
+  const memoryDir = join29(root, ".kxm", "memory");
+  const candidatesDir = join29(memoryDir, "candidates");
   return { memoryDir, candidatesDir };
 }
-function loadAuthoredMemory(repoRoot6) {
-  const { memoryDir } = memoryDirectories(repoRoot6);
-  if (!existsSync23(memoryDir)) return [];
+function loadAuthoredMemory(repoRoot) {
+  const { memoryDir } = memoryDirectories(repoRoot);
+  if (!existsSync25(memoryDir)) return [];
   const records = [];
   const entries = readdirSync9(memoryDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && extname2(entry.name) === ".md") {
-      const fullPath = join27(memoryDir, entry.name);
+      const fullPath = join29(memoryDir, entry.name);
       try {
-        const text = readFileSync23(fullPath, "utf8");
+        const text = readFileSync24(fullPath, "utf8");
         const record = parseMemoryRecord(text, entry.name);
         if (record.lifecycle === "active") {
           records.push(record);
@@ -34254,9 +34336,9 @@ function loadAuthoredMemory(repoRoot6) {
   }
   return records.sort((left, right) => left.id.localeCompare(right.id));
 }
-function createMemoryNote(repoRoot6, summary, options = {}) {
-  const { candidatesDir } = memoryDirectories(repoRoot6);
-  mkdirSync19(candidatesDir, { recursive: true });
+function createMemoryNote(repoRoot, summary, options = {}) {
+  const { candidatesDir } = memoryDirectories(repoRoot);
+  mkdirSync20(candidatesDir, { recursive: true });
   const scope = options.scope ?? "project";
   if (!VALID_SCOPES.has(scope)) {
     throw new Error(`invalid memory note scope: ${scope}; must be one of agent, project, run, operator`);
@@ -34281,12 +34363,12 @@ function createMemoryNote(repoRoot6, summary, options = {}) {
     evidenceRefs: [],
     ...options.body ? { body: options.body.trim() } : {}
   };
-  const targetPath = join27(candidatesDir, `${id}.md`);
-  writeFileSync18(targetPath, formatMemoryRecord(record), "utf8");
+  const targetPath = join29(candidatesDir, `${id}.md`);
+  writeFileSync19(targetPath, formatMemoryRecord(record), "utf8");
   return { record, path: targetPath };
 }
-function generateMemoryBrief(repoRoot6) {
-  const facts = loadAuthoredMemory(repoRoot6);
+function generateMemoryBrief(repoRoot) {
+  const facts = loadAuthoredMemory(repoRoot);
   return {
     schema: MEMORY_BRIEF_SCHEMA,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -34318,8 +34400,8 @@ function formatHarnessMemoryBlock(records) {
 }
 function updateHarnessDocument(filePath, block, defaultHeader) {
   let original = "";
-  if (existsSync23(filePath)) {
-    original = readFileSync23(filePath, "utf8");
+  if (existsSync25(filePath)) {
+    original = readFileSync24(filePath, "utf8");
   }
   let updated = "";
   if (original.includes(MEMORY_MARKER_START) && original.includes(MEMORY_MARKER_END)) {
@@ -34347,25 +34429,25 @@ ${block}
 `;
   }
   if (updated !== original) {
-    writeFileSync18(filePath, updated, "utf8");
+    writeFileSync19(filePath, updated, "utf8");
     return true;
   }
   return false;
 }
-function syncHarnessMemory(repoRoot6) {
-  const root = resolve22(repoRoot6);
+function syncHarnessMemory(repoRoot) {
+  const root = resolve22(repoRoot);
   const records = loadAuthoredMemory(root);
   const block = formatHarnessMemoryBlock(records);
   const updated = [];
   const created = [];
-  const agentsPath = join27(root, "AGENTS.md");
+  const agentsPath = join29(root, "AGENTS.md");
   const agentsHeader = "# AGENTS\n\nFollow project instructions.\n";
-  const agentsExisted = existsSync23(agentsPath);
+  const agentsExisted = existsSync25(agentsPath);
   if (updateHarnessDocument(agentsPath, block, agentsHeader)) {
     if (agentsExisted) updated.push("AGENTS.md");
     else created.push("AGENTS.md");
   }
-  const claudePath = join27(root, "CLAUDE.md");
+  const claudePath = join29(root, "CLAUDE.md");
   const claudeHeader = `# KXM (Claude)
 
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
@@ -34376,12 +34458,12 @@ you to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`).
 If \`grok\` is logged out, fail closed; do not fall back to Pi. Your reviews are
 artifacts, not hub \`peer-reply\` evidence.
 `;
-  const claudeExisted = existsSync23(claudePath);
+  const claudeExisted = existsSync25(claudePath);
   if (updateHarnessDocument(claudePath, block, claudeHeader)) {
     if (claudeExisted) updated.push("CLAUDE.md");
     else created.push("CLAUDE.md");
   }
-  const geminiPath = join27(root, "GEMINI.md");
+  const geminiPath = join29(root, "GEMINI.md");
   const geminiHeader = `# KXM (Gemini / Antigravity)
 
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
@@ -34390,7 +34472,7 @@ Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
 Google / Antigravity CLI (\`agy\`) is an admitted native writer and experiment edit route
 for Gemini models. Starting rotation remains Grok.
 `;
-  const geminiExisted = existsSync23(geminiPath);
+  const geminiExisted = existsSync25(geminiPath);
   if (updateHarnessDocument(geminiPath, block, geminiHeader)) {
     if (geminiExisted) updated.push("GEMINI.md");
     else created.push("GEMINI.md");
@@ -34401,8 +34483,8 @@ for Gemini models. Starting rotation remains Grok.
 // plugins/kxm/src/skills.ts
 var import_yaml15 = __toESM(require_dist(), 1);
 import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync20, readdirSync as readdirSync10, readFileSync as readFileSync24, renameSync as renameSync7, rmSync as rmSync9, statSync as statSync3, writeFileSync as writeFileSync19 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync21, readdirSync as readdirSync10, readFileSync as readFileSync25, renameSync as renameSync8, rmSync as rmSync10, statSync as statSync3, writeFileSync as writeFileSync20 } from "node:fs";
+import { join as join30 } from "node:path";
 var SKILL_CANDIDATE_SCHEMA = "kxm.skill-candidate.v1";
 var SKILL_EVALUATION_SCHEMA = "kxm.skill-evaluation.v1";
 var SKILL_DECISION_SCHEMA = "kxm.skill-decision.v1";
@@ -34496,48 +34578,48 @@ var SkillLifecycle = class {
     this.allowOptimizationEvals = options.allowOptimizationEvals === true;
   }
   dir(state) {
-    return join28(this.root, state === "candidate" ? "candidates" : `${state}s`.replace("rejecteds", "rejected").replace("promoteds", "promoted"));
+    return join30(this.root, state === "candidate" ? "candidates" : `${state}s`.replace("rejecteds", "rejected").replace("promoteds", "promoted"));
   }
   historyFile(id) {
-    return join28(this.root, "history", `${id}.jsonl`);
+    return join30(this.root, "history", `${id}.jsonl`);
   }
   paths(state, id) {
-    const dir = join28(this.dir(state), id);
-    return { dir, metadata: join28(dir, "metadata.json"), skill: join28(dir, "SKILL.md") };
+    const dir = join30(this.dir(state), id);
+    return { dir, metadata: join30(dir, "metadata.json"), skill: join30(dir, "SKILL.md") };
   }
   appendHistory(id, record) {
-    mkdirSync20(join28(this.root, "history"), { recursive: true });
+    mkdirSync21(join30(this.root, "history"), { recursive: true });
     const line = `${JSON.stringify(record)}
 `;
-    if (existsSync24(this.historyFile(id))) {
-      const existing = readFileSync24(this.historyFile(id), "utf8");
+    if (existsSync26(this.historyFile(id))) {
+      const existing = readFileSync25(this.historyFile(id), "utf8");
       const lines = existing.split("\n").filter((entry) => entry.trim());
-      writeFileSync19(this.historyFile(id), [...lines.slice(-499), line.trim()].join("\n") + "\n");
+      writeFileSync20(this.historyFile(id), [...lines.slice(-499), line.trim()].join("\n") + "\n");
     } else {
-      writeFileSync19(this.historyFile(id), line);
+      writeFileSync20(this.historyFile(id), line);
     }
   }
   history(id) {
     const file = this.historyFile(id);
-    if (!existsSync24(file)) return [];
-    return readFileSync24(file, "utf8").split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
+    if (!existsSync26(file)) return [];
+    return readFileSync25(file, "utf8").split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
   }
   readMetadata(state, id) {
     const { metadata } = this.paths(state, id);
-    if (!existsSync24(metadata)) {
+    if (!existsSync26(metadata)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${state}`);
     }
-    return JSON.parse(readFileSync24(metadata, "utf8"));
+    return JSON.parse(readFileSync25(metadata, "utf8"));
   }
   move(from, to, id) {
-    const fromDir = join28(this.dir(from), id);
-    const toDir = join28(this.dir(to), id);
-    if (!existsSync24(fromDir)) {
+    const fromDir = join30(this.dir(from), id);
+    const toDir = join30(this.dir(to), id);
+    if (!existsSync26(fromDir)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${from}`);
     }
-    mkdirSync20(this.dir(to), { recursive: true });
-    if (existsSync24(toDir)) rmSync9(toDir, { recursive: true, force: true });
-    renameSync7(fromDir, toDir);
+    mkdirSync21(this.dir(to), { recursive: true });
+    if (existsSync26(toDir)) rmSync10(toDir, { recursive: true, force: true });
+    renameSync8(fromDir, toDir);
   }
   /** Submit a new skill candidate. Content is redacted of secret material at
    * creation; the ID is derived from name + content hash. */
@@ -34579,7 +34661,7 @@ var SkillLifecycle = class {
     const contentSha256 = skillContentSha256(content);
     const id = skillIdFor(name, contentSha256);
     const { dir, metadata, skill } = this.paths("candidate", id);
-    if (existsSync24(metadata)) {
+    if (existsSync26(metadata)) {
       throw new SkillLifecycleError(
         "skill_candidate_exists",
         `identical candidate ${id} already exists; changed behavior requires changed content`
@@ -34598,9 +34680,9 @@ var SkillLifecycle = class {
       createdAt: this.now(),
       ...input.supersedes ? { supersedes: input.supersedes } : {}
     };
-    mkdirSync20(dir, { recursive: true });
-    writeFileSync19(skill, content);
-    writeFileSync19(metadata, `${JSON.stringify(record, null, 2)}
+    mkdirSync21(dir, { recursive: true });
+    writeFileSync20(skill, content);
+    writeFileSync20(metadata, `${JSON.stringify(record, null, 2)}
 `);
     this.appendHistory(id, { schema: "kxm.skill-history-event.v1", event: "candidate_created", by: createdBy, supersedes: input.supersedes, at: record.createdAt });
     return record;
@@ -34689,18 +34771,18 @@ var SkillLifecycle = class {
     };
     const candidatePaths = this.paths("candidate", candidateId);
     const promotedPaths = this.paths("promoted", candidateId);
-    mkdirSync20(promotedPaths.dir, { recursive: true });
-    const skillContent = readFileSync24(candidatePaths.skill, "utf8");
-    const metadataContent = readFileSync24(candidatePaths.metadata, "utf8");
-    writeFileSync19(promotedPaths.skill, skillContent);
-    writeFileSync19(promotedPaths.metadata, metadataContent);
-    const patchesDir = join28(this.root, "patches");
-    mkdirSync20(patchesDir, { recursive: true });
-    const patchPath = join28(patchesDir, `${candidateId}.patch`);
+    mkdirSync21(promotedPaths.dir, { recursive: true });
+    const skillContent = readFileSync25(candidatePaths.skill, "utf8");
+    const metadataContent = readFileSync25(candidatePaths.metadata, "utf8");
+    writeFileSync20(promotedPaths.skill, skillContent);
+    writeFileSync20(promotedPaths.metadata, metadataContent);
+    const patchesDir = join30(this.root, "patches");
+    mkdirSync21(patchesDir, { recursive: true });
+    const patchPath = join30(patchesDir, `${candidateId}.patch`);
     const relSkillPath = `.kxm/skills/promoted/${candidateId}/SKILL.md`;
     const relMetaPath = `.kxm/skills/promoted/${candidateId}/metadata.json`;
     const patch = `${createUnifiedPatch(relSkillPath, skillContent)}${createUnifiedPatch(relMetaPath, metadataContent)}`;
-    writeFileSync19(patchPath, patch, "utf8");
+    writeFileSync20(patchPath, patch, "utf8");
     this.appendHistory(candidateId, record);
     return { ...metadata, patch, patchPath };
   }
@@ -34724,7 +34806,7 @@ var SkillLifecycle = class {
   verify(state, id) {
     const metadata = this.readMetadata(state, id);
     const { skill } = this.paths(state, id);
-    const content = readFileSync24(skill, "utf8");
+    const content = readFileSync25(skill, "utf8");
     if (skillContentSha256(content) !== metadata.contentSha256) {
       throw new SkillLifecycleError(
         "skill_integrity_violation",
@@ -34742,7 +34824,7 @@ var SkillLifecycle = class {
   }
   list(state) {
     const dir = this.dir(state);
-    if (!existsSync24(dir)) return [];
+    if (!existsSync26(dir)) return [];
     const ids = readdirSorted(dir);
     return ids.map((id) => {
       try {
@@ -34755,7 +34837,7 @@ var SkillLifecycle = class {
   read(state, id) {
     const metadata = this.readMetadata(state, id);
     const { skill } = this.paths(state, id);
-    return { metadata, content: readFileSync24(skill, "utf8") };
+    return { metadata, content: readFileSync25(skill, "utf8") };
   }
 };
 function boundedList(value, field) {
@@ -34770,18 +34852,18 @@ function boundedList(value, field) {
   return [...new Set(refs)];
 }
 function readdirSorted(dir) {
-  return readdirSync10(dir).filter((entry) => statSync3(join28(dir, entry)).isDirectory()).sort();
+  return readdirSync10(dir).filter((entry) => statSync3(join30(dir, entry)).isDirectory()).sort();
 }
 
 // plugins/kxm/src/wiki.ts
-import { mkdirSync as mkdirSync21, writeFileSync as writeFileSync20 } from "node:fs";
-import { join as join29 } from "node:path";
+import { mkdirSync as mkdirSync22, writeFileSync as writeFileSync21 } from "node:fs";
+import { join as join31 } from "node:path";
 function writeCompiledWiki(root, wiki) {
   const written = [];
   for (const [relativePath, content] of [...wiki.pages].sort(([left], [right]) => left.localeCompare(right))) {
-    const absolute = join29(root, relativePath);
-    mkdirSync21(absolute.slice(0, absolute.lastIndexOf("/")), { recursive: true });
-    writeFileSync20(absolute, content);
+    const absolute = join31(root, relativePath);
+    mkdirSync22(absolute.slice(0, absolute.lastIndexOf("/")), { recursive: true });
+    writeFileSync21(absolute, content);
     written.push(relativePath);
   }
   return written;
@@ -34947,7 +35029,7 @@ function skillStateFromFlag(value) {
   throw new Error(`invalid skill state ${value}`);
 }
 function skillsRoot(runtime) {
-  return join30(runtime.dirs.workdir, ".kxm", "skills");
+  return join32(runtime.dirs.workdir, ".kxm", "skills");
 }
 function csv(value) {
   if (!value) return void 0;
@@ -34964,7 +35046,7 @@ async function cmdSkillsCreate(runtime, options) {
     const metadata = lifecycle.create({
       name: options.name,
       description: options.description ?? "",
-      content: readFileSync25(options.file, "utf8"),
+      content: readFileSync26(options.file, "utf8"),
       createdBy: options.createdBy,
       sources: {
         runIds: csv(options.run) ?? [],
@@ -35122,8 +35204,8 @@ async function cmdMemorySync(runtime) {
 
 // plugins/kxm/src/cli/hub.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
-import { existsSync as existsSync30, mkdirSync as mkdirSync25, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync10, writeFileSync as writeFileSync23 } from "node:fs";
-import { join as join40, resolve as resolve25 } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync26, readFileSync as readFileSync32, readdirSync as readdirSync12, rmSync as rmSync11, writeFileSync as writeFileSync24 } from "node:fs";
+import { join as join42, resolve as resolve25 } from "node:path";
 
 // node_modules/marked/lib/marked.esm.js
 function M() {
@@ -41056,19 +41138,19 @@ import * as path2 from "node:path";
 
 // node_modules/@earendil-works/pi-tui/dist/native-module-path.js
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname16, join as join31 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { dirname as dirname17, join as join33 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleRequire = createRequire2(import.meta.url);
 var TUI_PACKAGE_NAME = "@earendil-works/pi-tui";
 function getNativeModuleCandidates(nativePath, options = {}) {
-  const moduleDir = dirname16(fileURLToPath5(options.moduleUrl ?? import.meta.url));
+  const moduleDir = dirname17(fileURLToPath2(options.moduleUrl ?? import.meta.url));
   const candidates = [];
   try {
     const packageEntry = (options.resolvePackage ?? moduleRequire.resolve)(TUI_PACKAGE_NAME);
-    candidates.push(join31(dirname16(packageEntry), "..", nativePath));
+    candidates.push(join33(dirname17(packageEntry), "..", nativePath));
   } catch {
   }
-  candidates.push(join31(moduleDir, "..", nativePath), join31(moduleDir, nativePath), join31(dirname16(options.execPath ?? process.execPath), nativePath));
+  candidates.push(join33(moduleDir, "..", nativePath), join33(moduleDir, nativePath), join33(dirname17(options.execPath ?? process.execPath), nativePath));
   return Array.from(new Set(candidates));
 }
 
@@ -43524,8 +43606,8 @@ var TuiAltScreen = class extends TuiBase {
 var MAX_RENDER_WRITE_CHARS = 1024 * 1024;
 
 // plugins/kxm/src/tui.ts
-import { mkdirSync as mkdirSync22 } from "node:fs";
-import { join as join35, resolve as resolve24, dirname as dirname17 } from "node:path";
+import { mkdirSync as mkdirSync23 } from "node:fs";
+import { join as join37, resolve as resolve24, dirname as dirname18 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // plugins/kxm/src/external-effects.ts
@@ -43536,9 +43618,9 @@ function slugifyBranchPart(text, maxLength = 40) {
 }
 
 // plugins/kxm/src/local-snapshot.ts
-import { existsSync as existsSync25, readdirSync as readdirSync11, readFileSync as readFileSync26 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { isAbsolute as isAbsolute7, join as join34, resolve as resolve23 } from "node:path";
+import { existsSync as existsSync27, readdirSync as readdirSync11, readFileSync as readFileSync27 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { isAbsolute as isAbsolute8, join as join36, resolve as resolve23 } from "node:path";
 function processExists2(pid) {
   try {
     process.kill(pid, 0);
@@ -43658,36 +43740,36 @@ function readOpenMessageMetadata(database) {
   return messages;
 }
 function resolveKxmSnapshotPaths(cwd, env = process.env) {
-  const stateDir = env.KXM_STATE_DIR?.trim() || join34(cwd, ".kxm", "state");
+  const stateDir = env.KXM_STATE_DIR?.trim() || join36(cwd, ".kxm", "state");
   const configured = env.KXM_DATA_PATH?.trim();
-  const dataPath = configured ? resolve23(cwd, configured) : join34(stateDir, "kxm.db");
+  const dataPath = configured ? resolve23(cwd, configured) : join36(stateDir, "kxm.db");
   return { dataPath, stateDir };
 }
 function resolveVnextStateRoot(stateDir, options) {
-  if (options?.vnextStateRoot && existsSync25(options.vnextStateRoot)) {
+  if (options?.vnextStateRoot && existsSync27(options.vnextStateRoot)) {
     return resolve23(options.vnextStateRoot);
   }
-  if (existsSync25(join34(stateDir, "runtime", "registry.db")) || existsSync25(join34(stateDir, "runtime", "projects"))) {
+  if (existsSync27(join36(stateDir, "runtime", "registry.db")) || existsSync27(join36(stateDir, "runtime", "projects"))) {
     return stateDir;
   }
   const env = options?.env ?? process.env;
   const explicit = env.KXM_STATE_HOME?.trim() || env.KXM_USER_STATE_DIR?.trim() || env.KXM_STATE_ROOT?.trim();
-  if (explicit && isAbsolute7(explicit) && existsSync25(resolve23(explicit))) {
+  if (explicit && isAbsolute8(explicit) && existsSync27(resolve23(explicit))) {
     return resolve23(explicit);
   }
   let base;
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    base = localAppData && isAbsolute7(localAppData) ? localAppData : join34(homedir5(), "AppData", "Local");
+    base = localAppData && isAbsolute8(localAppData) ? localAppData : join36(homedir6(), "AppData", "Local");
     base = resolve23(base, "KXM");
   } else if (process.platform === "darwin") {
-    base = resolve23(homedir5(), "Library", "Application Support", "KXM");
+    base = resolve23(homedir6(), "Library", "Application Support", "KXM");
   } else {
     const xdgState = env.XDG_STATE_HOME?.trim();
-    base = xdgState && isAbsolute7(xdgState) ? xdgState : join34(homedir5(), ".local", "state");
+    base = xdgState && isAbsolute8(xdgState) ? xdgState : join36(homedir6(), ".local", "state");
     base = resolve23(base, "kxm");
   }
-  if (existsSync25(base)) return base;
+  if (existsSync27(base)) return base;
   return void 0;
 }
 function loadLocalMeshSnapshot(dataPath, stateDir, options) {
@@ -43698,7 +43780,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let legacyRuns = [];
   let legacyRunTotal = 0;
   let plans = [];
-  if (existsSync25(dataPath)) {
+  if (existsSync27(dataPath)) {
     hasLegacy = true;
     const database = new DatabaseSync(dataPath, { readOnly: true });
     try {
@@ -43718,11 +43800,11 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let vnextRunTotal = 0;
   const vnextStateRoot = resolveVnextStateRoot(stateDir, options);
   if (vnextStateRoot) {
-    const runtimeDir = join34(vnextStateRoot, "runtime");
-    const registryDbPath = join34(runtimeDir, "registry.db");
-    const projectsDir = join34(runtimeDir, "projects");
+    const runtimeDir = join36(vnextStateRoot, "runtime");
+    const registryDbPath = join36(runtimeDir, "registry.db");
+    const projectsDir = join36(runtimeDir, "projects");
     const projectKeys = /* @__PURE__ */ new Set();
-    if (existsSync25(registryDbPath)) {
+    if (existsSync27(registryDbPath)) {
       hasVnext = true;
       try {
         const regDb = new DatabaseSync(registryDbPath, { readOnly: true });
@@ -43738,7 +43820,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       } catch {
       }
     }
-    if (existsSync25(projectsDir)) {
+    if (existsSync27(projectsDir)) {
       try {
         for (const entry of readdirSync11(projectsDir, { withFileTypes: true })) {
           if (entry.isDirectory()) {
@@ -43749,8 +43831,8 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       }
     }
     for (const key of projectKeys) {
-      const eventDbPath = join34(projectsDir, key, "run-events.db");
-      if (existsSync25(eventDbPath)) {
+      const eventDbPath = join36(projectsDir, key, "run-events.db");
+      if (existsSync27(eventDbPath)) {
         hasVnext = true;
         try {
           const eventDb = new DatabaseSync(eventDbPath, { readOnly: true });
@@ -43780,10 +43862,10 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     }
   }
   const pids = [];
-  if (existsSync25(stateDir)) {
+  if (existsSync27(stateDir)) {
     for (const file of readdirSync11(stateDir).filter((name) => name.endsWith(".pid"))) {
       try {
-        const record = JSON.parse(readFileSync26(join34(stateDir, file), "utf8"));
+        const record = JSON.parse(readFileSync27(join36(stateDir, file), "utf8"));
         pids.push({
           file,
           ...record.role ? { role: record.role } : {},
@@ -43822,8 +43904,8 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   } else {
     source = "legacy";
   }
-  const telemetryFile = join34(stateDir, "telemetry.jsonl");
-  const spend = existsSync25(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
+  const telemetryFile = join36(stateDir, "telemetry.jsonl");
+  const spend = existsSync27(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
   return {
     source,
     agents: agents.sort((a, b2) => Number(b2.online) - Number(a.online) || a.name.localeCompare(b2.name)),
@@ -43938,10 +44020,10 @@ function copyToClipboard(text) {
     return false;
   }
 }
-function spawnDegradeWorktree(repoRoot6, runId, options) {
+function spawnDegradeWorktree(repoRoot, runId, options) {
   const runner = options?.execFn ?? ((cmd, args) => {
     const res = spawnSync5(cmd, args, {
-      cwd: repoRoot6,
+      cwd: repoRoot,
       encoding: "utf8",
       windowsHide: true,
       env: Object.fromEntries(
@@ -43957,11 +44039,11 @@ function spawnDegradeWorktree(repoRoot6, runId, options) {
   const cleanRunId = runId.replace(/^run_/, "");
   const desc = options?.description ? slugifyBranchPart(options.description, 30) : "degrade";
   const branchName = `kxm/run-${cleanRunId}-${desc}`;
-  const relativeWtPath = join35(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
-  const absoluteWtPath = resolve24(repoRoot6, relativeWtPath);
+  const relativeWtPath = join37(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
+  const absoluteWtPath = resolve24(repoRoot, relativeWtPath);
   const jumpCommand = `cd "${absoluteWtPath}"`;
   try {
-    mkdirSync22(dirname17(absoluteWtPath), { recursive: true });
+    mkdirSync23(dirname18(absoluteWtPath), { recursive: true });
     const branchCheck = runner("git", ["rev-parse", "--verify", `refs/heads/${branchName}`]);
     let wtRes;
     if (branchCheck.status === 0) {
@@ -44556,8 +44638,8 @@ async function runMeshTui(input) {
             body: JSON.stringify({ signalKey: "operator-degrade", status: "degraded", summary: "Degraded to operator worktree from kxm dash" }),
             signal: abort.signal
           });
-          const repoRoot6 = process.cwd();
-          const degradeRes = spawnDegradeWorktree(repoRoot6, targetId, {
+          const repoRoot = process.cwd();
+          const degradeRes = spawnDegradeWorktree(repoRoot, targetId, {
             description: "operator-degrade"
           });
           if (dashboard) {
@@ -44727,8 +44809,8 @@ async function runMeshTui(input) {
 // plugins/kxm/src/session-work.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID13 } from "node:crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync23, readFileSync as readFileSync27, renameSync as renameSync8, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join36 } from "node:path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync24, readFileSync as readFileSync28, renameSync as renameSync9, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join38 } from "node:path";
 var MAX_SESSION_BRIEF_TASKS = 5;
 var MAX_SESSION_BRIEF_PLANS = 5;
 var SESSION_BRIEF_SCHEMA = "kxm.session-brief.v1";
@@ -44884,10 +44966,10 @@ function buildSessionBrief(snapshot, current, hub, ship, updateLatest, cost, ses
   };
 }
 function readCachedSessionBrief(stateDir) {
-  const file = join36(stateDir, "session-brief.json");
+  const file = join38(stateDir, "session-brief.json");
   try {
-    if (!existsSync26(file)) return void 0;
-    const raw = readFileSync27(file, "utf8");
+    if (!existsSync28(file)) return void 0;
+    const raw = readFileSync28(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && parsed.schema === "kxm.session-brief.v1" && typeof parsed.generatedAt === "string") {
       const ageMs = Date.now() - Date.parse(parsed.generatedAt);
@@ -44902,18 +44984,18 @@ function readCachedSessionBrief(stateDir) {
 }
 function writeCachedSessionBrief(stateDir, brief) {
   try {
-    mkdirSync23(stateDir, { recursive: true, mode: 448 });
-    const file = join36(stateDir, "session-brief.json");
+    mkdirSync24(stateDir, { recursive: true, mode: 448 });
+    const file = join38(stateDir, "session-brief.json");
     const tmp = `${file}.tmp.${randomUUID13().slice(0, 8)}`;
-    writeFileSync21(tmp, JSON.stringify(brief, null, 2), { encoding: "utf8", mode: 384 });
-    renameSync8(tmp, file);
+    writeFileSync22(tmp, JSON.stringify(brief, null, 2), { encoding: "utf8", mode: 384 });
+    renameSync9(tmp, file);
   } catch {
   }
 }
 function estimateSessionCost(stateDir) {
   try {
-    const telemetryFile = join36(stateDir, "telemetry.jsonl");
-    if (!existsSync26(telemetryFile)) return void 0;
+    const telemetryFile = join38(stateDir, "telemetry.jsonl");
+    if (!existsSync28(telemetryFile)) return void 0;
     const records = readRoutingRecords(telemetryFile);
     if (records.length === 0) return void 0;
     let totalCost = 0;
@@ -45081,11 +45163,11 @@ function formatSessionBriefText(brief) {
 }
 
 // plugins/kxm/src/kxm-install-kind.ts
-import { existsSync as existsSync27, readFileSync as readFileSync28 } from "node:fs";
-import { dirname as dirname18, join as join37 } from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync29 } from "node:fs";
+import { dirname as dirname19, join as join39 } from "node:path";
 function packageIsKxm(root) {
   try {
-    const pkg = JSON.parse(readFileSync28(join37(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync29(join39(root, "package.json"), "utf8"));
     return pkg.name === "@kontextmind/kxm";
   } catch {
     return false;
@@ -45107,8 +45189,8 @@ function lastSegments(path4) {
 function segmentEq(left, right, platform) {
   return platform === "win32" ? left.toLocaleLowerCase("en-US") === right.toLocaleLowerCase("en-US") : left === right;
 }
-function isNpmPackageLayout(repoRoot6, platform) {
-  const last = lastSegments(repoRoot6);
+function isNpmPackageLayout(repoRoot, platform) {
+  const last = lastSegments(repoRoot);
   const expected = ["node_modules", "@kontextmind", "kxm"];
   return last.length === 3 && last.every((part, i) => segmentEq(part, expected[i], platform));
 }
@@ -45134,12 +45216,12 @@ function report(kind, root) {
   return { kind, root, instruction: installKindInstruction(kind, root) };
 }
 function classifyInstallRoot(probe) {
-  const piGitRoot = join37(probe.homeDir, ".pi", "agent", "git");
+  const piGitRoot = join39(probe.homeDir, ".pi", "agent", "git");
   if (isUnder(probe.repoRoot, piGitRoot, probe.platform)) return report("pi-git", probe.repoRoot);
-  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join37(probe.homeDir, ".claude");
-  const pluginsRoot = join37(claudeHome, "plugins");
+  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join39(probe.homeDir, ".claude");
+  const pluginsRoot = join39(claudeHome, "plugins");
   if (isUnder(probe.moduleDir, pluginsRoot, probe.platform)) return report("claude-marketplace", probe.moduleDir);
-  const hasGit = existsSync27(join37(probe.repoRoot, ".git"));
+  const hasGit = existsSync29(join39(probe.repoRoot, ".git"));
   if (hasGit && packageIsKxm(probe.repoRoot)) return report("source", probe.repoRoot);
   if (isNpmPackageLayout(probe.repoRoot, probe.platform) && packageIsKxm(probe.repoRoot) && !hasGit) {
     return report("npm-package", probe.repoRoot);
@@ -45153,21 +45235,21 @@ function resolveInstallKind(probe, npmGlobalRoot) {
   if (typeof globalRoot !== "string" || globalRoot.trim() === "") {
     return report("unknown", classified.root);
   }
-  const expected = dirname18(dirname18(classified.root));
+  const expected = dirname19(dirname19(classified.root));
   if (sameHostPath2(globalRoot.trim(), expected, probe.platform)) return report("npm-global", classified.root);
   return report("npm-local", classified.root);
 }
 
 // plugins/kxm/src/kxm-update-config.ts
 var import_yaml16 = __toESM(require_dist(), 1);
-import { existsSync as existsSync28, readFileSync as readFileSync29 } from "node:fs";
-import { join as join38 } from "node:path";
+import { existsSync as existsSync30, readFileSync as readFileSync30 } from "node:fs";
+import { join as join40 } from "node:path";
 function loadKxmUpdateConfig(env = process.env) {
-  const path4 = join38(vnextUserStateRoot({ env }), "update.yaml");
-  if (!existsSync28(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
+  const path4 = join40(vnextUserStateRoot({ env }), "update.yaml");
+  if (!existsSync30(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
   let parsed;
   try {
-    parsed = (0, import_yaml16.parse)(readFileSync29(path4, "utf8"));
+    parsed = (0, import_yaml16.parse)(readFileSync30(path4, "utf8"));
   } catch {
     throw new KxmUpdateConfigError("update.yaml is not valid YAML");
   }
@@ -45193,8 +45275,8 @@ function loadKxmUpdateConfig(env = process.env) {
 }
 
 // plugins/kxm/src/session.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync24, readFileSync as readFileSync30, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync25, readFileSync as readFileSync31, writeFileSync as writeFileSync23 } from "node:fs";
+import { join as join41 } from "node:path";
 var SESSION_SCHEMA = "kxm.session.v1";
 var SessionConfigError = class extends Error {
   code = "session_config_invalid";
@@ -45204,12 +45286,12 @@ var SessionConfigError = class extends Error {
   }
 };
 function workflowAssetDirs(assetsDir, workflowId) {
-  const root = join39(assetsDir, "workflows", workflowId);
-  return [root, join39(root, "inputs"), join39(root, "outputs"), join39(root, "generated")];
+  const root = join41(assetsDir, "workflows", workflowId);
+  return [root, join41(root, "inputs"), join41(root, "outputs"), join41(root, "generated")];
 }
 function sessionAssetDirs(assetsDir, sessionId) {
-  const root = join39(assetsDir, "sessions", sessionId);
-  return [root, join39(root, "inputs"), join39(root, "outputs")];
+  const root = join41(assetsDir, "sessions", sessionId);
+  return [root, join41(root, "inputs"), join41(root, "outputs")];
 }
 function rosterNames(configDir) {
   return [...loadRosterMap(configDir).values()].map((row) => String(row.name));
@@ -45259,7 +45341,7 @@ function workerFromRosterRow(name, row, project) {
 function loadRosterMap(configDir) {
   const byName = /* @__PURE__ */ new Map();
   for (const [file, key] of [["agents.json", "agents"], ["gates.json", "gates"]]) {
-    const path4 = join39(configDir, file);
+    const path4 = join41(configDir, file);
     for (const row of loadRoster(path4, key)) {
       const name = String(row.name).trim();
       const lowered = name.toLowerCase();
@@ -45273,10 +45355,10 @@ function loadRosterMap(configDir) {
   return byName;
 }
 function loadRoster(path4, key) {
-  if (!existsSync29(path4)) return [];
+  if (!existsSync31(path4)) return [];
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync30(path4, "utf8"));
+    parsed = JSON.parse(readFileSync31(path4, "utf8"));
   } catch (error) {
     throw new SessionConfigError(
       `${key} roster at ${path4} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
@@ -45301,7 +45383,7 @@ function loadRoster(path4, key) {
   });
 }
 function createSession(input) {
-  const assetDir = input.mode === "workflow" && input.workflowId ? join39("assets", "workflows", input.workflowId) : join39("assets", "sessions", input.id);
+  const assetDir = input.mode === "workflow" && input.workflowId ? join41("assets", "workflows", input.workflowId) : join41("assets", "sessions", input.id);
   return {
     schema: SESSION_SCHEMA,
     id: input.id,
@@ -45314,20 +45396,20 @@ function createSession(input) {
   };
 }
 function writeSession(assetsDir, session, dryRun = false) {
-  const dir = join39(assetsDir, "sessions", session.id);
-  const path4 = join39(dir, "session.json");
+  const dir = join41(assetsDir, "sessions", session.id);
+  const path4 = join41(dir, "session.json");
   if (!dryRun) {
-    mkdirSync24(dir, { recursive: true });
-    writeFileSync22(path4, `${JSON.stringify(session, null, 2)}
+    mkdirSync25(dir, { recursive: true });
+    writeFileSync23(path4, `${JSON.stringify(session, null, 2)}
 `, { encoding: "utf8" });
   }
   return path4;
 }
 
 // plugins/kxm/src/cli/hub.ts
-import { fileURLToPath as fileURLToPath6 } from "node:url";
-import { dirname as dirname19 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { dirname as dirname20 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 async function hubGet(url, fetchImpl) {
   try {
     const response = await fetchImpl(url);
@@ -45345,17 +45427,17 @@ async function hubGet(url, fetchImpl) {
 function installProbeFrom(runtime) {
   const partial = runtime.io.installProbe ?? {};
   return {
-    moduleDir: partial.moduleDir ?? dirname19(fileURLToPath6(import.meta.url)),
+    moduleDir: partial.moduleDir ?? dirname20(fileURLToPath3(import.meta.url)),
     repoRoot: partial.repoRoot ?? resolve25("."),
-    homeDir: partial.homeDir ?? homedir6(),
+    homeDir: partial.homeDir ?? homedir7(),
     platform: partial.platform ?? process.platform,
     env: partial.env ?? runtime.env
   };
 }
 function warnIgnoredProjectUpdateYaml(runtime) {
-  const projectFile = join40(runtime.dirs.workspace, "update.yaml");
-  if (!existsSync30(projectFile)) return;
-  const userFile = join40(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
+  const projectFile = join42(runtime.dirs.workspace, "update.yaml");
+  if (!existsSync32(projectFile)) return;
+  const userFile = join42(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
   runtime.io.stderr(`kxm: ignoring .kxm/update.yaml in ${runtime.dirs.workdir}; update settings are read only from ${userFile}
 `);
 }
@@ -45381,7 +45463,7 @@ async function cmdDash(runtime, options = {}) {
     return 2;
   }
   const screen = requested;
-  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join40(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join42(runtime.dirs.state, "kxm.db"));
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, {
       ok: true,
@@ -45427,7 +45509,7 @@ async function cmdHub(runtime) {
         config = loadKxmUpdateConfig(runtime.env);
       } catch (error) {
         if (error instanceof KxmUpdateConfigError) {
-          const yamlPath = join40(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
+          const yamlPath = join42(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
           runtime.io.stderr(`kxm: ${error.message}; update check skipped; fix or remove ${yamlPath}
 `);
         } else {
@@ -45563,7 +45645,7 @@ async function cmdWorker(runtime, options) {
   return await (runtime.io.spawnWorker ?? ((launchEnv) => spawnScript("kxm-worker.mjs", launchEnv)))(extraEnv);
 }
 async function cmdStop(runtime, waitMsFlag) {
-  const pids = existsSync30(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
+  const pids = existsSync32(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, { ok: true, command: "stop", dryRun: true, pidFiles: pids }, "would signal pid files");
     return 0;
@@ -45578,7 +45660,7 @@ async function cmdStop(runtime, waitMsFlag) {
   const orphans = [];
   for (const file of pids) {
     try {
-      const record = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
+      const record = JSON.parse(readFileSync32(join42(runtime.dirs.state, file), "utf8"));
       const expectedControl = file === "hub.pid" ? "hub.stop" : file.startsWith("worker-") ? `${file.slice(0, -4)}.stop` : void 0;
       const expectedRole = file === "hub.pid" ? "hub" : file.startsWith("worker-") ? "worker" : void 0;
       if (record.version !== 1 || !Number.isInteger(record.pid) || record.pid <= 0 || !record.startedAt || !expectedControl || record.controlFile !== expectedControl || record.role !== expectedRole) {
@@ -45598,7 +45680,7 @@ async function cmdStop(runtime, waitMsFlag) {
         ignored.push(file);
         continue;
       }
-      writeFileSync23(join40(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+      writeFileSync24(join42(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `, { encoding: "utf8", mode: 384 });
       requested.push(file);
       records.set(file, { pid: record.pid, startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {} });
@@ -45616,7 +45698,7 @@ async function cmdStop(runtime, waitMsFlag) {
   while (Date.now() <= deadline && stopped.size < requested.length) {
     for (const [file, record] of records) {
       try {
-        const current = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync32(join42(runtime.dirs.state, file), "utf8"));
         if (current.pid !== record.pid || current.startedAt !== record.startedAt || current.generation !== record.generation || !processExists(record.pid)) stopped.add(file);
       } catch {
         stopped.add(file);
@@ -45629,7 +45711,7 @@ async function cmdStop(runtime, waitMsFlag) {
   for (const file of orphans) {
     while (Date.now() <= deadlineOrphans) {
       try {
-        const current = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync32(join42(runtime.dirs.state, file), "utf8"));
         if (!Number.isInteger(current.serverPid) || !processExists(current.serverPid)) break;
       } catch {
         break;
@@ -45637,14 +45719,14 @@ async function cmdStop(runtime, waitMsFlag) {
       await (runtime.io.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms))))(100);
     }
     try {
-      const current = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
+      const current = JSON.parse(readFileSync32(join42(runtime.dirs.state, file), "utf8"));
       if (Number.isInteger(current.serverPid) && processExists(current.serverPid)) {
         try {
           process.kill(current.serverPid, "SIGKILL");
         } catch {
         }
       }
-      rmSync10(join40(runtime.dirs.state, file), { force: true });
+      rmSync11(join42(runtime.dirs.state, file), { force: true });
     } catch {
     }
     stopped.add(file);
@@ -45655,11 +45737,11 @@ async function cmdStop(runtime, waitMsFlag) {
 }
 async function cmdSessionStatus(runtime) {
   const stateDir = runtime.dirs.state;
-  const names3 = existsSync30(stateDir) ? readdirSync12(stateDir) : [];
+  const names3 = existsSync32(stateDir) ? readdirSync12(stateDir) : [];
   const claims = [];
   for (const file of names3.filter((name) => name.endsWith(".pid"))) {
     try {
-      const record = JSON.parse(readFileSync31(join40(stateDir, file), "utf8"));
+      const record = JSON.parse(readFileSync32(join42(stateDir, file), "utf8"));
       claims.push({
         file,
         role: record.role,
@@ -45674,7 +45756,7 @@ async function cmdSessionStatus(runtime) {
   const recoveries = [];
   for (const file of names3.filter((name) => name.startsWith("worker-recovery-") && name.endsWith(".json"))) {
     try {
-      const envelope = JSON.parse(readFileSync31(join40(stateDir, file), "utf8"));
+      const envelope = JSON.parse(readFileSync32(join42(stateDir, file), "utf8"));
       recoveries.push({
         file,
         reason: envelope.reason,
@@ -45779,7 +45861,7 @@ async function cmdSessionBrief(runtime, options = {}) {
     print(runtime.io, runtime.json, { ok: true, command: "session brief", sessionToken }, sessionToken);
     return 0;
   }
-  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join40(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join42(runtime.dirs.state, "kxm.db"));
   const env = {
     ...runtime.env,
     KXM_STATE_DIR: runtime.dirs.state,
@@ -45855,7 +45937,7 @@ async function cmdSessionStart(runtime, options) {
     ...workflowId ? workflowAssetDirs(runtime.dirs.assets, workflowId) : []
   ];
   if (!runtime.dryRun) {
-    for (const directory of created) mkdirSync25(directory, { recursive: true });
+    for (const directory of created) mkdirSync26(directory, { recursive: true });
     writeSession(runtime.dirs.assets, session);
   }
   print(runtime.io, runtime.json, {
@@ -45871,16 +45953,15 @@ async function cmdSessionStart(runtime, options) {
 // plugins/kxm/src/cli/system.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
-import { existsSync as existsSync36, mkdtempSync as mkdtempSync2, readFileSync as readFileSync36, rmSync as rmSync12 } from "node:fs";
+import { existsSync as existsSync38, mkdtempSync as mkdtempSync2, readFileSync as readFileSync37, rmSync as rmSync13 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join46, resolve as resolve29 } from "node:path";
+import { join as join48, resolve as resolve29 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // plugins/kxm/src/improve.ts
 import { createHash as createHash15 } from "node:crypto";
-import { existsSync as existsSync31, mkdirSync as mkdirSync26, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join41, relative as relative6, resolve as resolve26 } from "node:path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync27, writeFileSync as writeFileSync25 } from "node:fs";
+import { join as join43, relative as relative6, resolve as resolve26 } from "node:path";
 var CANDIDATE_SCHEMA = "kxm.candidate.v1";
 var IMPROVEMENT_REPORT_SCHEMA = "kxm.improvement-report.v2";
 function classifyCandidateKind(stepId, agentRole) {
@@ -46052,7 +46133,7 @@ function groupRoutingRecords(records, options = {}) {
 }
 function buildImprovementReport(records, options = {}) {
   const projectRoot = options.projectRoot ? resolve26(options.projectRoot) : process.cwd();
-  const candidatesDir = options.candidatesDir ? resolve26(options.candidatesDir) : join41(projectRoot, ".kxm", "candidates");
+  const candidatesDir = options.candidatesDir ? resolve26(options.candidatesDir) : join43(projectRoot, ".kxm", "candidates");
   const groups = groupRoutingRecords(records, options);
   const candidates = [];
   for (const group of groups) {
@@ -46064,7 +46145,7 @@ function buildImprovementReport(records, options = {}) {
       group.workflowHash
     );
     const diffFileName = `${group.candidateId}.diff`;
-    const diffFilePath = join41(candidatesDir, diffFileName);
+    const diffFilePath = join43(candidatesDir, diffFileName);
     const relDiffPath = relative6(projectRoot, diffFilePath).replace(/\\/g, "/");
     const candidate = {
       schema: CANDIDATE_SCHEMA,
@@ -46086,12 +46167,12 @@ function buildImprovementReport(records, options = {}) {
       createdAt: nowIso()
     };
     if (!options.dryRun) {
-      if (!existsSync31(candidatesDir)) {
-        mkdirSync26(candidatesDir, { recursive: true });
+      if (!existsSync33(candidatesDir)) {
+        mkdirSync27(candidatesDir, { recursive: true });
       }
-      writeFileSync24(diffFilePath, diff, "utf8");
-      const jsonFilePath = join41(candidatesDir, `${group.candidateId}.json`);
-      writeFileSync24(jsonFilePath, JSON.stringify(candidate, null, 2) + "\n", "utf8");
+      writeFileSync25(diffFilePath, diff, "utf8");
+      const jsonFilePath = join43(candidatesDir, `${group.candidateId}.json`);
+      writeFileSync25(jsonFilePath, JSON.stringify(candidate, null, 2) + "\n", "utf8");
     }
     candidates.push(candidate);
   }
@@ -46106,10 +46187,10 @@ function buildImprovementReport(records, options = {}) {
 }
 function writeImprovementReport(improvementsDir, report2, dryRun = false) {
   const stamp = report2.createdAt.replace(/[:.]/g, "-");
-  const path4 = join41(improvementsDir, `${stamp}.json`);
+  const path4 = join43(improvementsDir, `${stamp}.json`);
   if (!dryRun) {
-    mkdirSync26(improvementsDir, { recursive: true });
-    writeFileSync24(path4, `${JSON.stringify(report2, null, 2)}
+    mkdirSync27(improvementsDir, { recursive: true });
+    writeFileSync25(path4, `${JSON.stringify(report2, null, 2)}
 `, { encoding: "utf8" });
   }
   return path4;
@@ -46149,8 +46230,8 @@ function formatImprovementReport(report2) {
 
 // plugins/kxm/src/modes.ts
 var import_yaml17 = __toESM(require_dist(), 1);
-import { existsSync as existsSync32, readFileSync as readFileSync33 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync34, readFileSync as readFileSync34 } from "node:fs";
+import { join as join44 } from "node:path";
 var DEFAULT_MODES_CONFIG = Object.freeze({
   schema: "kxm.modes.v1",
   majorModes: {
@@ -46213,12 +46294,12 @@ function loadModesConfig(projectRoot) {
   if (!projectRoot) {
     return DEFAULT_MODES_CONFIG;
   }
-  const modesPath = join42(projectRoot, ".kxm", "modes.yaml");
-  if (!existsSync32(modesPath)) {
+  const modesPath = join44(projectRoot, ".kxm", "modes.yaml");
+  if (!existsSync34(modesPath)) {
     return DEFAULT_MODES_CONFIG;
   }
   try {
-    const raw = readFileSync33(modesPath, "utf8");
+    const raw = readFileSync34(modesPath, "utf8");
     const parsed = (0, import_yaml17.parse)(raw);
     if (parsed && parsed.schema === "kxm.modes.v1" && parsed.majorModes) {
       return {
@@ -46304,11 +46385,11 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
     estimatedTokens: estimateTokens(baseSystemPromptChars)
   });
   for (const relPath of resolved.contextFiles) {
-    const fullPath = join42(projectRoot, relPath);
+    const fullPath = join44(projectRoot, relPath);
     let chars = 0;
-    if (existsSync32(fullPath)) {
+    if (existsSync34(fullPath)) {
       try {
-        chars = readFileSync33(fullPath, "utf8").length;
+        chars = readFileSync34(fullPath, "utf8").length;
       } catch {
         chars = 0;
       }
@@ -46440,9 +46521,9 @@ ${divider}
 
 // plugins/kxm/src/ssh-remote.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync33, mkdirSync as mkdirSync27, readFileSync as readFileSync34, readdirSync as readdirSync13, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join43, resolve as resolve27 } from "node:path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync28, readFileSync as readFileSync35, readdirSync as readdirSync13, rmSync as rmSync12, statSync as statSync5 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join45, resolve as resolve27 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
 var MAX_SSH_OUTPUT_LINES = 2e3;
 var DEFAULT_SOCKET_DIR = ".kxm/run/ssh-sockets";
@@ -46468,12 +46549,12 @@ function truncateSshOutput(raw) {
   return { text, truncated };
 }
 function parseSshConfig(configPath) {
-  const targetPath = configPath ?? join43(homedir7(), ".ssh", "config");
-  if (!existsSync33(targetPath)) {
+  const targetPath = configPath ?? join45(homedir8(), ".ssh", "config");
+  if (!existsSync35(targetPath)) {
     return [];
   }
   try {
-    const content = readFileSync34(targetPath, "utf-8");
+    const content = readFileSync35(targetPath, "utf-8");
     const lines = content.split("\n");
     const hosts = [];
     let currentHosts = [];
@@ -46551,14 +46632,14 @@ function resolveSshHostG(host, execFn = spawnSync7) {
 }
 function ensureSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
   const resolved = resolve27(socketDir);
-  if (!existsSync33(resolved)) {
-    mkdirSync27(resolved, { recursive: true, mode: 448 });
+  if (!existsSync35(resolved)) {
+    mkdirSync28(resolved, { recursive: true, mode: 448 });
   }
   return resolved;
 }
 function buildSshArgs(options) {
   const socketDir = ensureSocketDir(options.socketDir ?? DEFAULT_SOCKET_DIR);
-  const controlPath = join43(socketDir, "%C");
+  const controlPath = join45(socketDir, "%C");
   const persist = options.controlPersist ?? DEFAULT_CONTROL_PERSIST;
   const args = [
     "-o",
@@ -46583,7 +46664,7 @@ function buildSshArgs(options) {
 }
 function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join43(resolvedDir, "%C");
+  const controlPath = join45(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "check", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -46595,7 +46676,7 @@ function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
 }
 function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join43(resolvedDir, "%C");
+  const controlPath = join45(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "stop", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -47041,9 +47122,9 @@ complete -c kxm -n "__fish_seen_subcommand_from goal" -a "create list get"
 }
 
 // plugins/kxm/src/completion-install.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync28, readFileSync as readFileSync35, writeFileSync as writeFileSync25 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { basename as basename9, delimiter, dirname as dirname21, isAbsolute as isAbsolute8, join as join44, resolve as resolve28 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync29, readFileSync as readFileSync36, writeFileSync as writeFileSync26 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { basename as basename9, delimiter, dirname as dirname22, isAbsolute as isAbsolute9, join as join46, resolve as resolve28 } from "node:path";
 var COMPLETION_MARKER = "# kxm completion";
 var PATH_MARKER = "# kxm path";
 function detectShell(env = process.env, platform = process.platform) {
@@ -47059,31 +47140,31 @@ function effectiveHome(options) {
   const env = options.env ?? process.env;
   if (options.homeDir) return options.homeDir;
   const envHome = env.HOME?.trim() ?? env.USERPROFILE?.trim();
-  return envHome && envHome.length > 0 ? resolve28(envHome) : homedir8();
+  return envHome && envHome.length > 0 ? resolve28(envHome) : homedir9();
 }
 function completionScriptPath(shell, options = {}) {
   const env = options.env ?? process.env;
   const explicit = options.configDir ?? env.KXM_USER_CONFIG_DIR?.trim();
   const base = explicit && explicit.length > 0 ? resolve28(explicit) : resolve28(effectiveHome(options), ".config", "kxm");
-  return join44(base, "completions", `kxm.${shell}`);
+  return join46(base, "completions", `kxm.${shell}`);
 }
 function bashRcCandidate(options) {
   const home = effectiveHome(options);
-  const candidates = [join44(home, ".bashrc"), join44(home, ".bash_profile")];
-  const existing = candidates.find((candidate) => existsSync34(candidate));
+  const candidates = [join46(home, ".bashrc"), join46(home, ".bash_profile")];
+  const existing = candidates.find((candidate) => existsSync36(candidate));
   return existing ?? candidates[0];
 }
 function zshRcCandidate(options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.ZDOTDIR?.trim()) return join44(resolve28(env.ZDOTDIR.trim()), ".zshrc");
-  return join44(home, ".zshrc");
+  if (env.ZDOTDIR?.trim()) return join46(resolve28(env.ZDOTDIR.trim()), ".zshrc");
+  return join46(home, ".zshrc");
 }
 function fishCompletionTarget(shell, options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.XDG_CONFIG_HOME?.trim()) return join44(resolve28(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
-  return join44(home, ".config", "fish", "completions", "kxm.fish");
+  if (env.XDG_CONFIG_HOME?.trim()) return join46(resolve28(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
+  return join46(home, ".config", "fish", "completions", "kxm.fish");
 }
 function completionRcTarget(shell, options = {}) {
   if (shell === "fish") {
@@ -47115,17 +47196,17 @@ function installShellCompletion(shellInput, options = {}) {
   const scriptPath = completionScriptPath(shell, options);
   const { rcFile } = completionRcTarget(shell, options);
   const script = generateShellCompletion(shell);
-  const existingScript = existsSync34(scriptPath);
-  const existingScriptMatches = existingScript && readFileSync35(scriptPath, "utf8") === script;
+  const existingScript = existsSync36(scriptPath);
+  const existingScriptMatches = existingScript && readFileSync36(scriptPath, "utf8") === script;
   let rcModified = false;
   let alreadyInstalled = false;
   if (shell === "fish") {
     const fishTarget = fishCompletionTarget(shell, options);
-    const fishInstalled = existsSync34(fishTarget) && readFileSync35(fishTarget, "utf8") === script;
+    const fishInstalled = existsSync36(fishTarget) && readFileSync36(fishTarget, "utf8") === script;
     alreadyInstalled = fishInstalled;
     if (!options.dryRun && (!fishInstalled || options.overwrite)) {
-      mkdirSync28(resolve28(fishTarget, ".."), { recursive: true });
-      writeFileSync25(fishTarget, script, { encoding: "utf8" });
+      mkdirSync29(resolve28(fishTarget, ".."), { recursive: true });
+      writeFileSync26(fishTarget, script, { encoding: "utf8" });
     }
     return {
       ok: true,
@@ -47138,13 +47219,13 @@ function installShellCompletion(shellInput, options = {}) {
   }
   if (rcFile) {
     const line = sourceLine(shell, scriptPath);
-    const rcContent = existsSync34(rcFile) ? readFileSync35(rcFile, "utf8") : "";
+    const rcContent = existsSync36(rcFile) ? readFileSync36(rcFile, "utf8") : "";
     alreadyInstalled = rcContent.includes(line) || rcContent.includes(`${COMPLETION_MARKER}`);
   }
   if (!options.dryRun) {
     if (!existingScriptMatches || options.overwrite) {
-      mkdirSync28(resolve28(scriptPath, ".."), { recursive: true });
-      writeFileSync25(scriptPath, script, { encoding: "utf8" });
+      mkdirSync29(resolve28(scriptPath, ".."), { recursive: true });
+      writeFileSync26(scriptPath, script, { encoding: "utf8" });
     }
     if (rcFile && !alreadyInstalled) {
       const line = sourceLine(shell, scriptPath);
@@ -47153,8 +47234,8 @@ function installShellCompletion(shellInput, options = {}) {
 ${marker}
 ${line}
 `;
-      mkdirSync28(resolve28(rcFile, ".."), { recursive: true });
-      writeFileSync25(rcFile, (existsSync34(rcFile) ? readFileSync35(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
+      mkdirSync29(resolve28(rcFile, ".."), { recursive: true });
+      writeFileSync26(rcFile, (existsSync36(rcFile) ? readFileSync36(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
       rcModified = true;
     }
   }
@@ -47169,15 +47250,15 @@ ${line}
 }
 function kxmBinDir(env = process.env) {
   const argv1 = env.KXM_ENTRY ?? process.argv[1];
-  if (argv1 && isAbsolute8(argv1)) {
-    const dir = dirname21(argv1);
-    if (existsSync34(join44(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
+  if (argv1 && isAbsolute9(argv1)) {
+    const dir = dirname22(argv1);
+    if (existsSync36(join46(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
   }
   const pathEnv = env.PATH ?? "";
   for (const part of pathEnv.split(delimiter)) {
     if (!part) continue;
     const candidate = resolve28(part, process.platform === "win32" ? "kxm.cmd" : "kxm");
-    if (existsSync34(candidate)) return resolve28(part);
+    if (existsSync36(candidate)) return resolve28(part);
   }
   return void 0;
 }
@@ -47195,11 +47276,11 @@ function installPathEntry(shellInput, options = {}) {
   }
   const { rcFile } = completionRcTarget(shell, options);
   const line = pathLine(binDir);
-  const rcContent = existsSync34(rcFile ?? "") ? readFileSync35(rcFile, "utf8") : "";
+  const rcContent = existsSync36(rcFile ?? "") ? readFileSync36(rcFile, "utf8") : "";
   const alreadyInstalled = rcContent.includes(binDir) || (options.env?.PATH ?? process.env.PATH ?? "").split(delimiter).includes(binDir);
   if (!options.dryRun && rcFile && !alreadyInstalled) {
-    mkdirSync28(dirname21(rcFile), { recursive: true });
-    writeFileSync25(rcFile, rcContent + `
+    mkdirSync29(dirname22(rcFile), { recursive: true });
+    writeFileSync26(rcFile, rcContent + `
 ${PATH_MARKER}
 ${line}
 `, { encoding: "utf8" });
@@ -47209,8 +47290,8 @@ ${line}
 
 // plugins/kxm/src/init-guide-setup.ts
 var import_yaml18 = __toESM(require_dist(), 1);
-import { existsSync as existsSync35, mkdirSync as mkdirSync29, writeFileSync as writeFileSync26 } from "node:fs";
-import { dirname as dirname22, join as join45 } from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync30, writeFileSync as writeFileSync27 } from "node:fs";
+import { dirname as dirname23, join as join47 } from "node:path";
 var NATIVE_VENDOR_HARNESS = Object.freeze({
   anthropic: "claude",
   openai: "codex",
@@ -47609,13 +47690,13 @@ function renderGuideSetupFiles(projectRoot, plan) {
     const stage = roleStages.get(role);
     if (!stage) continue;
     files.push({
-      path: join45(projectRoot, ".kxm", "agents", `${role}.yaml`),
+      path: join47(projectRoot, ".kxm", "agents", `${role}.yaml`),
       content: (0, import_yaml18.stringify)(agentDocument(role, stage, binding))
     });
   }
   for (const workflow of plan.workflows) {
     files.push({
-      path: join45(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
+      path: join47(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
       content: (0, import_yaml18.stringify)(workflowDocument(workflow))
     });
   }
@@ -47625,12 +47706,12 @@ function writeGuideSetupFiles(files) {
   const written = [];
   const existed = [];
   for (const file of files) {
-    if (existsSync35(file.path)) {
+    if (existsSync37(file.path)) {
       existed.push(file.path);
       continue;
     }
-    mkdirSync29(dirname22(file.path), { recursive: true });
-    writeFileSync26(file.path, file.content, "utf8");
+    mkdirSync30(dirname23(file.path), { recursive: true });
+    writeFileSync27(file.path, file.content, "utf8");
     written.push(file.path);
   }
   return { written, existed };
@@ -47653,7 +47734,6 @@ function parseGuideSelection(input, catalog = GUIDE_WORKFLOWS) {
 }
 
 // plugins/kxm/src/cli/system.ts
-var repoRoot4 = resolve29(fileURLToPath7(new URL("../../../../", import.meta.url)));
 function cliSpawn(runtime, command, args, extra) {
   if (runtime.io.spawnSync) return runtime.io.spawnSync(command, args);
   const result = spawnSync8(command, [...args], {
@@ -47694,7 +47774,7 @@ function applyKxmPackageUpdate(runtime, notice) {
       detail: `release v${notice.latest} has no sha256 digest for ${name}; refusing to install`
     };
   }
-  const releaseDir = mkdtempSync2(join46(tmpdir2(), "kxm-pkg-update-"));
+  const releaseDir = mkdtempSync2(join48(tmpdir2(), "kxm-pkg-update-"));
   try {
     const planned = planKxmPackageUpdate(notice.source, notice.latest, releaseDir, notice.asset);
     if (runtime.dryRun) {
@@ -47703,7 +47783,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     for (const step of planned) {
       if (step.kind === "verify") {
         if (!verifyReleaseAssetDigest(step.path, step.sha256)) {
-          const actual = existsSync36(step.path) ? createHash16("sha256").update(readFileSync36(step.path)).digest("hex") : "missing";
+          const actual = existsSync38(step.path) ? createHash16("sha256").update(readFileSync37(step.path)).digest("hex") : "missing";
           return {
             ok: false,
             error: "release_digest_mismatch",
@@ -47720,7 +47800,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     }
     return { ok: true, detail: `installed ${notice.latest} from ${notice.source}` };
   } finally {
-    rmSync12(releaseDir, { recursive: true, force: true });
+    rmSync13(releaseDir, { recursive: true, force: true });
   }
 }
 async function cmdExplain(runtime, options) {
@@ -47822,7 +47902,7 @@ async function cmdUpdate(runtime, harness, options) {
   warnIgnoredProjectUpdateYaml(runtime);
   const probe = installProbeFrom(runtime);
   const classified = classifyInstallRoot(probe);
-  const current = readInstalledKxmVersion(repoRoot4);
+  const current = readInstalledKxmVersion(findKxmRepoRoot(import.meta.url));
   let notice;
   let kindReport = classified;
   if (classified.kind === "source") {
@@ -47969,12 +48049,12 @@ async function cmdValidate(runtime, fileFlag) {
   }
   const selectedFile = explicitFile || configuredFile;
   const file = selectedFile ? resolve29(runtime.cwd, selectedFile) : void 0;
-  if (file && !existsSync36(file)) {
+  if (file && !existsSync38(file)) {
     printWorker(runtime, worker, { ok: false, command: "validate", error: "file_not_found", file }, `workflow file not found: ${file}`);
     return 1;
   }
   try {
-    const raw = file ? readFileSync36(file, "utf8") : inline;
+    const raw = file ? readFileSync37(file, "utf8") : inline;
     const warnings = [];
     const definitions = parseWorkflowDefinitions(raw, runtime.env, (message) => warnings.push(message));
     const secretEnvs = definitions.map((definition) => ({
@@ -48019,14 +48099,14 @@ async function cmdArtifactsExist(runtime, pathFlag) {
 }
 async function cmdImprove(runtime, options = {}) {
   const file = options.file ? resolve29(runtime.cwd, options.file) : telemetryPath(runtime.dirs.logs);
-  const routingRecords = existsSync36(file) ? readRoutingRecords(file).map((entry) => entry.routing) : [];
-  const candidatesDir = options.outDir ? resolve29(runtime.cwd, options.outDir) : join46(runtime.cwd, ".kxm", "candidates");
+  const routingRecords = existsSync38(file) ? readRoutingRecords(file).map((entry) => entry.routing) : [];
+  const candidatesDir = options.outDir ? resolve29(runtime.cwd, options.outDir) : join48(runtime.cwd, ".kxm", "candidates");
   const report2 = buildImprovementReport(routingRecords, {
     candidatesDir,
     projectRoot: runtime.cwd,
     dryRun: runtime.dryRun
   });
-  const reportDir = join46(runtime.dirs.assets, "improvements");
+  const reportDir = join48(runtime.dirs.assets, "improvements");
   const reportPath = writeImprovementReport(reportDir, report2, runtime.dryRun);
   const text = formatImprovementReport(report2);
   print(runtime.io, runtime.json, {
@@ -48158,9 +48238,9 @@ async function maybeOfferCompletionInstall(runtime) {
   if (!pathNeeded) {
     const scriptPath = completionScriptPath(shell, { env: runtime.env, configDir: runtime.env.KXM_USER_CONFIG_DIR });
     const { rcFile } = completionRcTarget(shell, { env: runtime.env });
-    if (rcFile && existsSync36(rcFile)) {
+    if (rcFile && existsSync38(rcFile)) {
       try {
-        if (readFileSync36(rcFile, "utf8").includes(scriptPath)) return;
+        if (readFileSync37(rcFile, "utf8").includes(scriptPath)) return;
       } catch {
       }
     }
@@ -48292,7 +48372,7 @@ async function cmdRoutingReport(runtime, options) {
   let catalog;
   if (includeEquivalentListCost) {
     try {
-      const pricesPath = options.prices ? resolve29(runtime.cwd, options.prices) : join46(runtime.dirs.workspace, "prices.yaml");
+      const pricesPath = options.prices ? resolve29(runtime.cwd, options.prices) : join48(runtime.dirs.workspace, "prices.yaml");
       catalog = loadPriceCatalog(pricesPath);
     } catch {
     }
@@ -48376,7 +48456,12 @@ async function cmdRoutingBenchmark(runtime, options) {
 
 // plugins/kxm/src/cli.ts
 var CLI_NAME2 = "kxm";
-var repoRoot5 = resolve30(fileURLToPath8(new URL("../../../", import.meta.url)));
+function resolveCliAuthToken(runtime, project) {
+  const envToken = runtime.env.KXM_AUTH_TOKEN?.trim();
+  if (envToken) return envToken;
+  const record = readHubEnvRecord(runtime.env);
+  return record?.projectTokens?.[project]?.trim() || record?.authToken?.trim() || void 0;
+}
 var USAGE_ERROR_CODES = /* @__PURE__ */ new Set([
   "commander.help",
   "commander.helpDisplayed",
@@ -48398,12 +48483,13 @@ async function ensureCliClient(runtime) {
   const project = defaultProjectName(runtime.cwd, runtime.env);
   const name = runtime.env.KXM_AGENT_NAME?.trim() || `cli-${process.pid}`;
   const purpose = runtime.env.KXM_AGENT_PURPOSE?.trim() || "CLI agent client";
-  const authToken = runtime.env.KXM_AUTH_TOKEN?.trim();
+  const authToken = resolveCliAuthToken(runtime, project);
   const client = new HubClient({
     serverUrl,
     name,
     project,
     purpose,
+    fetchImpl: runtime.fetchImpl,
     ...authToken ? { authToken } : {}
   });
   await client.start(() => {
@@ -48519,7 +48605,7 @@ function createProgram(ctx, result) {
     };
   };
   const program2 = new Command(CLI_NAME2);
-  program2.description("KontextMind local-first orchestration CLI").version(readInstalledKxmVersion(repoRoot5), "-V, --version", "Print the installed kxm version").exitOverride().configureOutput({
+  program2.description("KontextMind local-first orchestration CLI").version(readInstalledKxmVersion(findKxmRepoRoot(import.meta.url)), "-V, --version", "Print the installed kxm version").exitOverride().configureOutput({
     writeOut: (text) => ctx.io.stdout(text),
     writeErr: (text) => ctx.io.stderr(text)
   }).helpCommand("help", "Show help");
@@ -48986,7 +49072,7 @@ async function runCli(argv, env = process.env, io = { stdout: (text) => process.
     throw error;
   }
 }
-if (process.argv[1] && resolve30(process.argv[1]) === fileURLToPath8(import.meta.url)) {
+if (process.argv[1] && resolve30(process.argv[1]) === fileURLToPath4(import.meta.url)) {
   const code = await runCli(process.argv.slice(2));
   process.exitCode = code;
 }